{
    "apiVersion": "v1",
    "items": [
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.redhat.com/nudged-components": "gl-multi-component-child-wbsn",
                    "build.appstudio.redhat.com/nudging-commit": "89c4a340128401f78bbc7eb30a7c7c3475f75156",
                    "build.appstudio.redhat.com/nudging-component": "gl-multi-component-parent-wbsn",
                    "build.appstudio.redhat.com/nudging-image": "quay.io/redhat-appstudio-qe/build-e2e-msbh/gl-multi-component-parent-wbsn:89c4a340128401f78bbc7eb30a7c7c3475f75156",
                    "build.appstudio.redhat.com/nudging-pipeline": "gl-multi-component-parent-wbsn-on-push-zg62r",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-msbh/results/69b248e4-b8a3-4226-a3c9-28eea02c61b4/records/c86f9b15-f0e1-4ca6-860e-2695b1f0d4ce",
                    "results.tekton.dev/result": "build-e2e-msbh/results/69b248e4-b8a3-4226-a3c9-28eea02c61b4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-69c7e127edfd4e1a1ee84826a652c08f-120de42df1413809-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:55:20Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "build.appstudio.redhat.com/type": "nudge",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-pipeline-1778198119-a059d",
                    "tekton.dev/pipelineRun": "renovate-pipeline-1778198119-a059d",
                    "tekton.dev/pipelineRunUID": "69b248e4-b8a3-4226-a3c9-28eea02c61b4",
                    "tekton.dev/pipelineTask": "renovate"
                },
                "name": "renovate-pipeline-1778198119-a059d-renovate",
                "namespace": "build-e2e-msbh",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-pipeline-1778198119-a059d",
                        "uid": "69b248e4-b8a3-4226-a3c9-28eea02c61b4"
                    }
                ],
                "resourceVersion": "120050",
                "uid": "c86f9b15-f0e1-4ca6-860e-2695b1f0d4ce"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-wbsn",
                "taskSpec": {
                    "steps": [
                        {
                            "command": [
                                "bash",
                                "-c",
                                "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_bfddfe6e40 RENOVATE_CONFIG_FILE=/configs/gl-multi-component-child-wbsn-fa364.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_msbh_gl_multi_component_parent_wbsn_3171bcace9','password':'${TOKEN_a57044ef51}'}]\" renovate"
                            ],
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                }
                            ],
                            "envFrom": [
                                {
                                    "prefix": "TOKEN_",
                                    "secretRef": {
                                        "name": "renovate-pipeline-1778198119-a059d"
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31",
                            "name": "renovate",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "seccompProfile": {
                                    "type": "RuntimeDefault"
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/configs",
                                    "name": "renovate-pipeline-1778198119-a059d"
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "name": "renovate-pipeline-1778198119-a059d"
                            },
                            "name": "renovate-pipeline-1778198119-a059d"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "renovate-ca-1778198119-a059d"
                            },
                            "name": "trusted-ca"
                        }
                    ]
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:55:33Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:55:33Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-pipeline-1778198119-a059d-renovate-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-69c7e127edfd4e1a1ee84826a652c08f-120de42df1413809-01"
                },
                "startTime": "2026-05-07T23:55:20Z",
                "steps": [
                    {
                        "container": "step-renovate",
                        "imageID": "quay.io/konflux-ci/mintmaker-renovate-image@sha256:67d26b20533790565a2949a3f732d595dda9378fea506f1cba88ca17cef13873",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2a83cc6e91b05acee47fba2cb824ad43b41972316ef72eed916a85248fd3f8f0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:55:33Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:55:24Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "command": [
                                "bash",
                                "-c",
                                "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_bfddfe6e40 RENOVATE_CONFIG_FILE=/configs/gl-multi-component-child-wbsn-fa364.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_msbh_gl_multi_component_parent_wbsn_3171bcace9','password':'${TOKEN_a57044ef51}'}]\" renovate"
                            ],
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                }
                            ],
                            "envFrom": [
                                {
                                    "prefix": "TOKEN_",
                                    "secretRef": {
                                        "name": "renovate-pipeline-1778198119-a059d"
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31",
                            "name": "renovate",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "seccompProfile": {
                                    "type": "RuntimeDefault"
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/configs",
                                    "name": "renovate-pipeline-1778198119-a059d"
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "name": "renovate-pipeline-1778198119-a059d"
                            },
                            "name": "renovate-pipeline-1778198119-a059d"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "renovate-ca-1778198119-a059d"
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/commit_sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vppbbl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-push-946q5",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vpgn\n\nRHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6/records/3b75fe7c-3f68-4958-8454-a68abf3c110e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f832ae3bd81a47a989487368f6f58ffa-92174734810da1d2-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:56Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRunUID": "697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check"
                },
                "name": "gh-2777147492797010a950b7f555fa8a00-deprecated-base-image-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-push-946q5",
                        "uid": "697903ad-5b17-4ac8-af99-dcff3f958ea6"
                    }
                ],
                "resourceVersion": "99577",
                "uid": "3b75fe7c-3f68-4958-8454-a68abf3c110e"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:08Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:08Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-2777147492797010a950b7f5feecfeff76012b602ce71c055ad572df-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\", \"digests\": [\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:08+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":1,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-f832ae3bd81a47a989487368f6f58ffa-92174734810da1d2-01"
                },
                "startTime": "2026-05-07T23:47:56Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5f0177c988590a1f0a6f3f054b1108d208cb2885b363b10313315d18afa23929",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:08Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\\\", \\\"digests\\\": [\\\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:08+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":1,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:00Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/commit_sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zamzpm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a/records/04f4985e-97c8-4ec9-a02b-54e7aaf98d37",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b111cfc751770a2eb5313cc86b3979b3-86258aa8738ec2a7-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:42:12Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRunUID": "4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-58ebf296a7d6d3f322b32bcaa94753e6-deprecated-base-image-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                        "uid": "4a282620-c0a2-43db-8944-5ab0ca68119a"
                    }
                ],
                "resourceVersion": "81895",
                "uid": "04f4985e-97c8-4ec9-a02b-54e7aaf98d37"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:42:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:42:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-58ebf296a7d6d3f322b32bca9c8ca19f72050b2fe089b3a8f3bd25f6-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\", \"digests\": [\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-07T23:42:30+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-b111cfc751770a2eb5313cc86b3979b3-86258aa8738ec2a7-01"
                },
                "startTime": "2026-05-07T23:42:14Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://100cf338585fe7c8ff9cb5bdd1a81ab6787f180f9db5d0439c490c73a15ae9f7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:30Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\\\", \\\"digests\\\": [\\\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-07T23:42:30+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:23Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/commit_sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dpevdh",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769/records/443e357f-0190-465c-81ef-03edb4c1fe67",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"93439bead5fdc5b0825565724621d742755e312f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-91cf7322fc4ebbab4601024e235725b4-f3610e3678398fce-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:42:05Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRunUID": "02506fd4-2a27-4c99-93ad-42213701e769",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "03052f006b5c7c771657e1d07d1e95f6876a8761a97121114e9d445b86a341"
                },
                "name": "gh-8bf383d4fba5bc88174358ac96f4e0f6-deprecated-base-image-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                        "uid": "02506fd4-2a27-4c99-93ad-42213701e769"
                    }
                ],
                "resourceVersion": "81307",
                "uid": "443e357f-0190-465c-81ef-03edb4c1fe67"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:42:17Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:42:17Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-8bf383d4fba5bc88174358acf6eb2ba786c1260d70075606260e3bc9-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\", \"digests\": [\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:42:17+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":1,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-91cf7322fc4ebbab4601024e235725b4-f3610e3678398fce-01"
                },
                "startTime": "2026-05-07T23:42:06Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://454ee8b36c8be6a9b90931e1436a02b8e1448e94d0955dafbaf688cc927a4f0e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:17Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\\\", \\\"digests\\\": [\\\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:42:17+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":1,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:10Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/commit_sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-doqzna",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-sjq7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31/records/612b1f88-005b-4a14-8ee8-b66bb922f7ea",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"eventType\":\"push\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5359416df3724cd31f790fce09404dbe-c9602f9dcb6b2861-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:57Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRunUID": "830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check"
                },
                "name": "gh-e624a5e968ed655a0df9ca9849a9f074-deprecated-base-image-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-sjq7v",
                        "uid": "830038fa-c26b-4b1f-8d7b-e7071a748e31"
                    }
                ],
                "resourceVersion": "99837",
                "uid": "612b1f88-005b-4a14-8ee8-b66bb922f7ea"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:11Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:11Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-e624a5e968ed655a0df9ca9859c9493f94b70f78fda16beecfe157ee-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197\", \"digests\": [\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-07T23:48:11+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5359416df3724cd31f790fce09404dbe-c9602f9dcb6b2861-01"
                },
                "startTime": "2026-05-07T23:47:57Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://62de4f1def753441671868e703c101b8a94d949ba1ead50e3cff318eafe4e7e9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:11Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197\\\", \\\"digests\\\": [\\\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:11+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:03Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/commit_sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vhjudv",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-4dhlx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nRHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1/records/1734f1c3-17ce-436a-beb1-2a7aa26a3843",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bfaf542f7e69e5381facc273838160b8-94d4066d89587918-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:48:28Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRunUID": "75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check"
                },
                "name": "gh-f943dcaa14db8147819580e46c004999-deprecated-base-image-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-4dhlx",
                        "uid": "75d2a0cc-fd61-4020-9958-3a2c65125ca1"
                    }
                ],
                "resourceVersion": "103586",
                "uid": "1734f1c3-17ce-436a-beb1-2a7aa26a3843"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:44Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:44Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-f943dcaa14db8147819580e4bfb7422fab39986423042959b03eb71b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149\", \"digests\": [\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-07T23:48:43+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bfaf542f7e69e5381facc273838160b8-94d4066d89587918-01"
                },
                "startTime": "2026-05-07T23:48:28Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2c551b00838a106598ed51bf47d490d1d6a066b8abb4aeaea354f271928f7783",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:43Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149\\\", \\\"digests\\\": [\\\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:43+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:33Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/commit_sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wlqyyr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b/records/af64fd4a-53b2-4f8b-86a1-140c5a34e432",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-cb1cd650ce2d918c3906351e721fa882-95f7a76e15d79ec6-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:47:51Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRunUID": "205bfe99-6331-4308-b533-c79b03e92d2b",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-fa4e560be39b4c3206280eccf098219a-deprecated-base-image-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                        "uid": "205bfe99-6331-4308-b533-c79b03e92d2b"
                    }
                ],
                "resourceVersion": "99146",
                "uid": "af64fd4a-53b2-4f8b-86a1-140c5a34e432"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:05Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:05Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-fa4e560be39b4c3206280ecca6f298b6984c700822efc37ffd0ea202-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\", \"digests\": [\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-07T23:48:04+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-cb1cd650ce2d918c3906351e721fa882-95f7a76e15d79ec6-01"
                },
                "startTime": "2026-05-07T23:47:51Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4e00f51d9707f765212d1c1e58cc91136559af960e289c71e664d7b00f0518d6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:04Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\\\", \\\"digests\\\": [\\\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:04+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:57Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/commit_sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vppbbl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-push-946q5",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vpgn\n\nRHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6/records/d933fb7e-d443-4d4f-8e49-e812bdad9b32",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f832ae3bd81a47a989487368f6f58ffa-7ba2850d7b4cbd8a-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:44:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRunUID": "697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min"
                },
                "name": "gh-multi-2777147492797010a950b7f555fa8a00-prefetch-dependencies",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-push-946q5",
                        "uid": "697903ad-5b17-4ac8-af99-dcff3f958ea6"
                    }
                ],
                "resourceVersion": "91504",
                "uid": "d933fb7e-d443-4d4f-8e49-e812bdad9b32"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-vppbbl"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:45:05Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:45:05Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-2777147492797010a9c48f58b5aedccfb9ba7b198b605ff8fb-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-f832ae3bd81a47a989487368f6f58ffa-7ba2850d7b4cbd8a-01"
                },
                "startTime": "2026-05-07T23:44:16Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ef959e90e609afb40e5596541b9a1f17923c3c7049c8e78d1bd68ece654d3f10",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:20Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://aabba87e643ec0e6ed11c8d8331ae01f171efc74c9f0adf2ca6854d12e708f6e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:21Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1a089b7688c448af5e556524864df8310bdd363702a3bca24cb67ebdc9933d9f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:04Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7a723fcf795efc1eb6694ddf9f0f07160fde7372a5d7474327c2f7b95f17b374",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:05Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:05Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/commit_sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zamzpm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a/records/f098f019-7262-4e92-b428-f983f405b47d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b111cfc751770a2eb5313cc86b3979b3-7719ef2705ef16bb-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:34:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRunUID": "4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-58ebf296a7d6d3f322b32bcaa94753e6-prefetch-dependencies",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                        "uid": "4a282620-c0a2-43db-8944-5ab0ca68119a"
                    }
                ],
                "resourceVersion": "67019",
                "uid": "f098f019-7262-4e92-b428-f983f405b47d"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-zamzpm"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:35:49Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:35:49Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-58ebf296a7d6d3f32223c95b6a4fb3e6d152ff8a0c620ff970-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-b111cfc751770a2eb5313cc86b3979b3-7719ef2705ef16bb-01"
                },
                "startTime": "2026-05-07T23:34:36Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9d7bc73f93383708cde6d661d12cdbf5629e25e8c5143d114edb06bfff0d863b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:34:41Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:34:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://82da3c1f9287c74c5bbca9139952f731d5c60c96439dd6486d23aadd17babe09",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:34:41Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:34:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://032879eb6c2bb47a087db821123b9c8ed12ba1a8ff2e901c5eb1d51d8bb9f3d3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:21Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:34:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://509b22ca0d32f3eb5acafac6a42959979b4e6cfd8077074258f4097571a466ae",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:47Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:21Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/commit_sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dpevdh",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769/records/cd77a9f7-ae7f-4c39-805c-dccab3423f9c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"93439bead5fdc5b0825565724621d742755e312f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-91cf7322fc4ebbab4601024e235725b4-903cabba6b4f3a39-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:35:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRunUID": "02506fd4-2a27-4c99-93ad-42213701e769",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "03052f006b5c7c771657e1d07d1e95f6876a8761a97121114e9d445b86a341"
                },
                "name": "gh-multi-8bf383d4fba5bc88174358ac96f4e0f6-prefetch-dependencies",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                        "uid": "02506fd4-2a27-4c99-93ad-42213701e769"
                    }
                ],
                "resourceVersion": "69955",
                "uid": "cd77a9f7-ae7f-4c39-805c-dccab3423f9c"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-dpevdh"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:36:53Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:36:53Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-8bf383d4fba5bc8817633e81be2c5a72e1ecc2c51ab8837c03-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-91cf7322fc4ebbab4601024e235725b4-903cabba6b4f3a39-01"
                },
                "startTime": "2026-05-07T23:35:57Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://303c72c2ed7f2f2cedada1600a9e63de0c385dc32b9ca69f886fccb0314816ad",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:02Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:36:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://162a2fb7bb4fade67070af1f3e4d449bf739ea634b08d5c235f83b5d716f1980",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:02Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:36:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5add6f42b288ffe20770bdb9f6bba1729ec2753edba57e1c791e79e9943e8f31",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:51Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:36:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://332dddd4d0b7a15ce291e57486b67d9917148f7434dcac69df50bafa7c30f263",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:51Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:36:47Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/commit_sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vppbbl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-push-946q5",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vpgn\n\nRHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6/records/5f8f11ba-fb3f-4b68-9874-d95cc43c4f52",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f832ae3bd81a47a989487368f6f58ffa-8d9fc2487badb232-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:56Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRunUID": "697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan"
                },
                "name": "gh-multi-co2777147492797010a950b7f555fa8a00-rpms-signature-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-push-946q5",
                        "uid": "697903ad-5b17-4ac8-af99-dcff3f958ea6"
                    }
                ],
                "resourceVersion": "102655",
                "uid": "5f8f11ba-fb3f-4b68-9874-d95cc43c4f52"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:39Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:39Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-co2777147492797010de881b65d438084814fee7250f6bed1d-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\", \"digests\": [\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 106, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:38+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-f832ae3bd81a47a989487368f6f58ffa-8d9fc2487badb232-01"
                },
                "startTime": "2026-05-07T23:47:56Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://33bb8bead874b0c2e88251ef95e8a54330a315f9ea7b70106a10318f84b03ac3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:37Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://632f884146d222387e984e4d3553741535a6b4967ab6de5e4db9f8f9820bbcea",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:38Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\\\", \\\"digests\\\": [\\\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 106, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:38+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:38Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/commit_sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zamzpm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a/records/1e2367d6-9719-401e-8b88-15ff1697af19",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b111cfc751770a2eb5313cc86b3979b3-f7c9528c50f3f2c1-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:42:13Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRunUID": "4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-co58ebf296a7d6d3f322b32bcaa94753e6-rpms-signature-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                        "uid": "4a282620-c0a2-43db-8944-5ab0ca68119a"
                    }
                ],
                "resourceVersion": "82109",
                "uid": "1e2367d6-9719-401e-8b88-15ff1697af19"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:42:32Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:42:32Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-co58ebf296a7d6d3f3fefe77513b4e103b9c2732d7520ecd43-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\", \"digests\": [\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:42:31+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-b111cfc751770a2eb5313cc86b3979b3-f7c9528c50f3f2c1-01"
                },
                "startTime": "2026-05-07T23:42:14Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d7af1b8bab6422d2cd20c2da8b0a9164d9a7ce89bcb526de527ca7c341c2ad11",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:30Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4419321b5493c530a989e0577f3e67ff7f631d9463cd87ace02843597d20b377",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:31Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\\\", \\\"digests\\\": [\\\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:42:31+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:31Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/commit_sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dpevdh",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769/records/0b1d1f9b-7936-4641-87c2-0ff2e89f8def",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"93439bead5fdc5b0825565724621d742755e312f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-91cf7322fc4ebbab4601024e235725b4-3453c67994f91228-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:42:06Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRunUID": "02506fd4-2a27-4c99-93ad-42213701e769",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "03052f006b5c7c771657e1d07d1e95f6876a8761a97121114e9d445b86a341"
                },
                "name": "gh-multi-co8bf383d4fba5bc88174358ac96f4e0f6-rpms-signature-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                        "uid": "02506fd4-2a27-4c99-93ad-42213701e769"
                    }
                ],
                "resourceVersion": "81788",
                "uid": "0b1d1f9b-7936-4641-87c2-0ff2e89f8def"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:42:26Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:42:26Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-co8bf383d4fba5bc88a79405aa1f36a84f5ede677eacb1a227-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\", \"digests\": [\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 106, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:42:25+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-91cf7322fc4ebbab4601024e235725b4-3453c67994f91228-01"
                },
                "startTime": "2026-05-07T23:42:06Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8264ce5c721349312b42fa24a625b0ef88f1b6bba87fee580fd98a029c56b716",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:25Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://faf392b3ced56c61bac60611f4258ee1e4fb3ede4fe80db2cbc9ef5fc505c7cf",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:26Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\\\", \\\"digests\\\": [\\\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 106, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:42:25+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:25Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/commit_sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wlqyyr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b/records/7e46ef62-a442-48c0-8102-8e1ff8bf1df3",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-cb1cd650ce2d918c3906351e721fa882-808898efe27e9fd1-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:47:51Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRunUID": "205bfe99-6331-4308-b533-c79b03e92d2b",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-cofa4e560be39b4c3206280eccf098219a-rpms-signature-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                        "uid": "205bfe99-6331-4308-b533-c79b03e92d2b"
                    }
                ],
                "resourceVersion": "102359",
                "uid": "7e46ef62-a442-48c0-8102-8e1ff8bf1df3"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:36Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:36Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-cofa4e560be39b4c324ac1b3a776b3471b81889f2e81b2c747-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\", \"digests\": [\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:35+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-cb1cd650ce2d918c3906351e721fa882-808898efe27e9fd1-01"
                },
                "startTime": "2026-05-07T23:47:52Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://111232e58efed3a0aa61f98453d93d61ec69fad05693f806cddb9d208b368334",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:34Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://51fa617774ef541c1a2e83639d3ff7a35ccce4097e893697e07e46fbf17f96ed",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:35Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\\\", \\\"digests\\\": [\\\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:35+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:35Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/commit_sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zamzpm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a/records/946a621f-31b1-4907-a141-a1079a24df6f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b111cfc751770a2eb5313cc86b3979b3-62d55bab3e61200a-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:42:13Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRunUID": "4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-com58ebf296a7d6d3f322b32bcaa94753e6-sast-unicode-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                        "uid": "4a282620-c0a2-43db-8944-5ab0ca68119a"
                    }
                ],
                "resourceVersion": "81768",
                "uid": "946a621f-31b1-4907-a141-a1079a24df6f"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:42:25Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:42:25Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-com58ebf296a7d6d3f13b1c590ab37882e5826f9cf94f5ddf0-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:42:23+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-b111cfc751770a2eb5313cc86b3979b3-62d55bab3e61200a-01"
                },
                "startTime": "2026-05-07T23:42:13Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0de4f4683f2cfa0dd7158ab41607864f495f009e150dd5f10d84cac89901f38c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:21Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f690f8d5564cb2372a1239b16745a2d93247e5c4901751d32fc4115d4c552bdc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:23Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:42:23+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://eb23bfb9591dbe1540e60bee39525b8f25d94a77ed76057ea80655b3684f9f4e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:25Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:42:23+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:24Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/commit_sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dpevdh",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769/records/0dfbf9bf-c586-40b5-90bf-3e4469e9ab8f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"93439bead5fdc5b0825565724621d742755e312f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-91cf7322fc4ebbab4601024e235725b4-102161fe264c8355-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:42:06Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRunUID": "02506fd4-2a27-4c99-93ad-42213701e769",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "03052f006b5c7c771657e1d07d1e95f6876a8761a97121114e9d445b86a341"
                },
                "name": "gh-multi-com8bf383d4fba5bc88174358ac96f4e0f6-sast-unicode-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                        "uid": "02506fd4-2a27-4c99-93ad-42213701e769"
                    }
                ],
                "resourceVersion": "84482",
                "uid": "0dfbf9bf-c586-40b5-90bf-3e4469e9ab8f"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:43:10Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:43:10Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-com8bf383d4fba5bc817506d6654be9c954c00fdd530278d63-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:43:07+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-91cf7322fc4ebbab4601024e235725b4-102161fe264c8355-01"
                },
                "startTime": "2026-05-07T23:42:06Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e1de382c64c48db5cd347e34ab42be9925a4bf5e0486ab58ddc75af0deaa867d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:06Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://06d85f542e932140717945141ba93f470d1fdd6ddde8b94655c9dcf8097785cb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:07Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:43:07+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://842f54a469b8f422cfa0faec80ebdb54ecb246768a5b57f0200db1e7598e8808",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:09Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:43:07+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:08Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/commit_sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wlqyyr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b/records/b3421468-d022-4fee-83f4-bb456c7b2e47",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-cb1cd650ce2d918c3906351e721fa882-9198b515b869824b-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:47:51Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRunUID": "205bfe99-6331-4308-b533-c79b03e92d2b",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-comfa4e560be39b4c3206280eccf098219a-sast-unicode-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                        "uid": "205bfe99-6331-4308-b533-c79b03e92d2b"
                    }
                ],
                "resourceVersion": "98934",
                "uid": "b3421468-d022-4fee-83f4-bb456c7b2e47"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:00Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:00Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-comfa4e560be39b4c30512697085276b4a02215ea0228fe67a-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:47:58+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-cb1cd650ce2d918c3906351e721fa882-9198b515b869824b-01"
                },
                "startTime": "2026-05-07T23:47:51Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://808d3b3b0549c976bb369530526b8501bce74e9faa4ef00612d487861af8dc14",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:56Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0ac608a3cd09429aff89aac54080b179f5ee1da5e01c17427a7466ca6bd5aed6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:58Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:47:58+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5074457d8dca4540b70e45c8e3b43c1456bbeb5cf842f60c3bf8c5ecda3a31da",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:00Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:47:58+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:59Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/commit_sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zamzpm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a/records/1a93f455-3973-4a57-b3fd-dcc086caa6a1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b111cfc751770a2eb5313cc86b3979b3-028d737a84c0b62c-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:38:08Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRunUID": "4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-comp58ebf296a7d6d3f322b32bcaa94753e6-build-image-index",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                        "uid": "4a282620-c0a2-43db-8944-5ab0ca68119a"
                    }
                ],
                "resourceVersion": "81086",
                "uid": "1a93f455-3973-4a57-b3fd-dcc086caa6a1"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:42:12Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:42:12Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-comp58ebf296a7d6d3321693827757c000445dd41c382de26a-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-b111cfc751770a2eb5313cc86b3979b3-028d737a84c0b62c-01"
                },
                "startTime": "2026-05-07T23:38:08Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://61ec688069a2c62a61742c5685827d766f0d4ac36ed86c88bcca6f959292397f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:40:44Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f11e390c15e3f31f8dbe063f17052a45ec3deffdb76e79bda487248b9ab1d89b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:40:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://62d95d8d8b413c3c2e183b22f5746f3d3fb01a3f955219e1e138dca59d0f50ac",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:40:48Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gh-multi-comp58ebf296a7d6d3f322b32bcaa94753e6-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/commit_sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dpevdh",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769/records/5968f07f-d03f-4ff9-aac5-be53bfcf4608",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"93439bead5fdc5b0825565724621d742755e312f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-91cf7322fc4ebbab4601024e235725b4-c66eb9864d85dd11-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:41:55Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRunUID": "02506fd4-2a27-4c99-93ad-42213701e769",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "03052f006b5c7c771657e1d07d1e95f6876a8761a97121114e9d445b86a341"
                },
                "name": "gh-multi-comp8bf383d4fba5bc88174358ac96f4e0f6-build-image-index",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                        "uid": "02506fd4-2a27-4c99-93ad-42213701e769"
                    }
                ],
                "resourceVersion": "80434",
                "uid": "5968f07f-d03f-4ff9-aac5-be53bfcf4608"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:42:05Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:42:05Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-comp8bf383d4fba5bc92abfa4e267e6c59ecea6e839014de7b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-91cf7322fc4ebbab4601024e235725b4-c66eb9864d85dd11-01"
                },
                "startTime": "2026-05-07T23:41:55Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d9e3fd6acdb636123a3af8401c47f13a1e437678c664cf918d1a26acd9b30765",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:03Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8d0585d088d8c194b23bfdde8b0b78d1888f403d41c124f2960c46ad713ae84e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:03Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:03Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2afc89f2a80810c50cc06f3505582018c61892d8cf9444e40584ad00c61ea8a5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:05Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:03Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gh-multi-comp8bf383d4fba5bc88174358ac96f4e0f6-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/commit_sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wlqyyr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b/records/c1531c8a-0d52-4874-964f-6288d6048aff",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-cb1cd650ce2d918c3906351e721fa882-44c40a0e52d24533-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:47:40Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRunUID": "205bfe99-6331-4308-b533-c79b03e92d2b",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-compfa4e560be39b4c3206280eccf098219a-build-image-index",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                        "uid": "205bfe99-6331-4308-b533-c79b03e92d2b"
                    }
                ],
                "resourceVersion": "98793",
                "uid": "c1531c8a-0d52-4874-964f-6288d6048aff"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:47:51Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:47:51Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compfa4e560be39b4c62a36b9e045885cd0a48e3bf8bd4559a-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-cb1cd650ce2d918c3906351e721fa882-44c40a0e52d24533-01"
                },
                "startTime": "2026-05-07T23:47:40Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://16b714c0155ca2fafaf28484c98bafc66932beb682c318efa380ede3e4f24325",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:48Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://19735431f19fc0ba598b292fa3b30c1be2c523f53c7b901a15c0b1f32ef6a017",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:48Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ac6292c5a5810d67ac880bd59698dda862cdc23ce53bf34b58a0e6464ffdbc7f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:50Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:48Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gh-multi-compfa4e560be39b4c3206280eccf098219a-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/commit_sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zamzpm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a/records/e75dded9-1ed1-481d-a78c-11dd6bb7fc9e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b111cfc751770a2eb5313cc86b3979b3-e7caa3979779ff43-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:34:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRunUID": "4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-compo58ebf296a7d6d3f322b32bcaa94753e6-clone-repository",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                        "uid": "4a282620-c0a2-43db-8944-5ab0ca68119a"
                    }
                ],
                "resourceVersion": "62937",
                "uid": "e75dded9-1ed1-481d-a78c-11dd6bb7fc9e"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "revision",
                        "value": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-zamzpm"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:34:36Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:34:36Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compo58ebf296a7d6db113cb898e91896854e67cf3d6561dfd-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778196847"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "7e92c9e"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-b111cfc751770a2eb5313cc86b3979b3-e7caa3979779ff43-01"
                },
                "startTime": "2026-05-07T23:34:27Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1457d5913eb4e08e0d78200ddaaad0652f3cd25bce777d733433b80afe852d4e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:34:33Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1},{\"key\":\"commit\",\"value\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778196847\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"7e92c9e\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:34:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d1c253d63b0cd37a178e35d6ba095659281c5d48b9f1e7d6130298937d284b85",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:34:34Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1},{\"key\":\"commit\",\"value\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778196847\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"7e92c9e\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:34:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://feb2d8263b981fd22b66e04ffbdbcc0be9acec65b133d6a0da34873122178d31",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:34:35Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5\",\"type\":1},{\"key\":\"commit\",\"value\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778196847\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"7e92c9e\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:34:34Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/commit_sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zamzpm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a/records/e499fd03-5b44-48ea-b24c-ec3ac516c60f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b111cfc751770a2eb5313cc86b3979b3-a3d701dadf01ec64-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:42:13Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRunUID": "4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-compo58ebf296a7d6d3f322b32bcaa94753e6-sast-shell-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                        "uid": "4a282620-c0a2-43db-8944-5ab0ca68119a"
                    }
                ],
                "resourceVersion": "82495",
                "uid": "e499fd03-5b44-48ea-b24c-ec3ac516c60f"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:42:37Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:42:37Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compo58ebf296a7d6d35faf514cd08ff04d49d4dfd97c9dadd-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:42:35+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-b111cfc751770a2eb5313cc86b3979b3-a3d701dadf01ec64-01"
                },
                "startTime": "2026-05-07T23:42:16Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0b2bcf992b0037f8ad199b6e6a1e5905710e499ac3037ce787a0043e12e4760d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:22Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://47eb5a1c54bc8bc4e65b654a0d564dde2f0afd29b6be0d00ff6cecb514cd12ed",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:35Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:42:35+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6d1219f903fb928f0bccde0125be9949d171dc092f21271c03a5b55567b2825f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:37Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:42:35+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:36Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/commit_sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dpevdh",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769/records/b7db14af-6947-4f3a-902a-0f503668bd84",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"93439bead5fdc5b0825565724621d742755e312f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-91cf7322fc4ebbab4601024e235725b4-8fb537c66d69df00-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:35:20Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRunUID": "02506fd4-2a27-4c99-93ad-42213701e769",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "03052f006b5c7c771657e1d07d1e95f6876a8761a97121114e9d445b86a341"
                },
                "name": "gh-multi-compo8bf383d4fba5bc88174358ac96f4e0f6-clone-repository",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                        "uid": "02506fd4-2a27-4c99-93ad-42213701e769"
                    }
                ],
                "resourceVersion": "67376",
                "uid": "b7db14af-6947-4f3a-902a-0f503668bd84"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt"
                    },
                    {
                        "name": "revision",
                        "value": "93439bead5fdc5b0825565724621d742755e312f"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-dpevdh"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:35:56Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:35:56Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compo8bf383d4fba5bb38ff9272782b1f0f91657f130e382b2-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "93439bead5fdc5b0825565724621d742755e312f"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "93439bead5fdc5b0825565724621d742755e312f"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778196897"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "93439be"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-91cf7322fc4ebbab4601024e235725b4-8fb537c66d69df00-01"
                },
                "startTime": "2026-05-07T23:35:21Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2562602636e6ef040483ea91564a27a97422b862ad65fa57f604eacb1217638b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:53Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"93439bead5fdc5b0825565724621d742755e312f\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt\",\"type\":1},{\"key\":\"commit\",\"value\":\"93439bead5fdc5b0825565724621d742755e312f\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778196897\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"93439be\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://761ad70462533cbf99a6a50f8392fd4b01608d89de3b2f948d12e25058717d05",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:54Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"93439bead5fdc5b0825565724621d742755e312f\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt\",\"type\":1},{\"key\":\"commit\",\"value\":\"93439bead5fdc5b0825565724621d742755e312f\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778196897\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"93439be\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:54Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://18682539b703a88931e0159b8f0b9e9780d5f474776f8f011524861282dbdead",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:55Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"93439bead5fdc5b0825565724621d742755e312f\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e\",\"type\":1},{\"key\":\"commit\",\"value\":\"93439bead5fdc5b0825565724621d742755e312f\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778196897\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"93439be\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:54Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "93439bead5fdc5b0825565724621d742755e312f"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/commit_sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dpevdh",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769/records/62c60d88-a949-42f8-b8af-7d25b866f1a6",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"93439bead5fdc5b0825565724621d742755e312f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-91cf7322fc4ebbab4601024e235725b4-98dd6607be558fb3-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:42:06Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRunUID": "02506fd4-2a27-4c99-93ad-42213701e769",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "03052f006b5c7c771657e1d07d1e95f6876a8761a97121114e9d445b86a341"
                },
                "name": "gh-multi-compo8bf383d4fba5bc88174358ac96f4e0f6-sast-shell-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                        "uid": "02506fd4-2a27-4c99-93ad-42213701e769"
                    }
                ],
                "resourceVersion": "82196",
                "uid": "62c60d88-a949-42f8-b8af-7d25b866f1a6"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:42:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:42:34Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compo8bf383d4fba5b99e861b76ab04dc7ce2fd521067491b4-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:42:31+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-91cf7322fc4ebbab4601024e235725b4-98dd6607be558fb3-01"
                },
                "startTime": "2026-05-07T23:42:06Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://812ed6ddd2e51282a81b216aa31d03232d7cb868fab5a896b8b712f86c1be49a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:17Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://144bb7a5d5e5bd851cb10ea9e03b0c9c0841f79b0590e00d9cc9673d891dda2c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:31Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:42:31+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://daf79364822cc72e43c4db2f092429af78337752786eafaa6f1b9284a4c910d4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:32Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:42:31+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:31Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/commit_sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wlqyyr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b/records/245ff578-9ca7-4a28-bb3d-b0b7a0e64cf2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-cb1cd650ce2d918c3906351e721fa882-ab53cf86f1312baa-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:44:03Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRunUID": "205bfe99-6331-4308-b533-c79b03e92d2b",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-compofa4e560be39b4c3206280eccf098219a-clone-repository",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                        "uid": "205bfe99-6331-4308-b533-c79b03e92d2b"
                    }
                ],
                "resourceVersion": "88116",
                "uid": "245ff578-9ca7-4a28-bb3d-b0b7a0e64cf2"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "revision",
                        "value": "554eb24cc796489c97912e7edff1125b39ecca22"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-wlqyyr"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:44:12Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:44:12Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compofa4e560be39b450f01b668db6246654dab7eb9d6d7b6f-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "554eb24cc796489c97912e7edff1125b39ecca22"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "554eb24cc796489c97912e7edff1125b39ecca22"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778197427"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "554eb24"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-cb1cd650ce2d918c3906351e721fa882-ab53cf86f1312baa-01"
                },
                "startTime": "2026-05-07T23:44:03Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c9c7c0c6d0352a81dc45bfc76404cbb75bde6a3f4231286b72e84a7d00ee721a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:09Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1},{\"key\":\"commit\",\"value\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197427\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"554eb24\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:09Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8215d6fd5b29f53bcbbb1aea50e4d063e9f42c5bb8028cc9945f0a4d25945257",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:10Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1},{\"key\":\"commit\",\"value\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197427\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"554eb24\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://549abc6d0373939f958d3881958d0247156240d0c9576c2cf3b6425770292f72",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:11Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6\",\"type\":1},{\"key\":\"commit\",\"value\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197427\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"554eb24\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:10Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "554eb24cc796489c97912e7edff1125b39ecca22"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/commit_sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wlqyyr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b/records/fc8fbcc8-af8a-4e17-bd4e-f3edd5ec4872",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-cb1cd650ce2d918c3906351e721fa882-7fc5a71cc806f0ff-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:47:51Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRunUID": "205bfe99-6331-4308-b533-c79b03e92d2b",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-compofa4e560be39b4c3206280eccf098219a-sast-shell-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                        "uid": "205bfe99-6331-4308-b533-c79b03e92d2b"
                    }
                ],
                "resourceVersion": "100196",
                "uid": "fc8fbcc8-af8a-4e17-bd4e-f3edd5ec4872"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:14Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compofa4e560be39b4386c850e505bd0affcb8d04f88bf6519-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:12+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-cb1cd650ce2d918c3906351e721fa882-7fc5a71cc806f0ff-01"
                },
                "startTime": "2026-05-07T23:47:54Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://717850de4c2345e8e25a7739b5deaa6607217fe4aeb8fa09b20309d46127f278",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:58Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ddbea2596f5f98aad75d37205d102312b2676bbff775da2af3d1b971f421c936",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:12Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:12+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8c55aaa682ef14dd0efb9125d3bab600644a9cf6e68146c529f037153cc9e210",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:12+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:13Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/commit_sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zamzpm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a/records/11354200-bff9-4a1e-8155-2418205f2be8",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b111cfc751770a2eb5313cc86b3979b3-f823f3c61d692aa7-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:35:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRunUID": "4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-compon58ebf296a7d6d3f322b32bcaa94753e6-build-container",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                        "uid": "4a282620-c0a2-43db-8944-5ab0ca68119a"
                    }
                ],
                "resourceVersion": "73515",
                "uid": "11354200-bff9-4a1e-8155-2418205f2be8"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:38:08Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:38:08Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compon58ebf296a7d6c8747a13df92a0091bf96538de5a7a5a-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:fb8c3a2aab49f9978035692b2af711f712775a053841a771f349d5dd59a3cbd1"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-b111cfc751770a2eb5313cc86b3979b3-f823f3c61d692aa7-01"
                },
                "startTime": "2026-05-07T23:35:50Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a8b0c7f250ae1c98c9bd0541eb04e087a9a1823850a12b541e72bc655efe963e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:58Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4a59818da1039a2cadf6ca6901f71c1a97d7ba75774b3959e6951ceb56f6d245",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:14Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://45e19789a18f6b247e4b9238e65d112da46e0786e55e50c223b5f677ceca54b0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:49Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:36:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9e7aa3d566c37f23d330dc798a5ac130b30a04ecd258215dda27098b6e47990b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:37:10Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:36:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d4099e6de80b4fe16d844c12d1f0545de6d24893d6bb6ebd89fa7804cb6592ca",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:37:36Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:37:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ca28871e48b0393026eb45cc994df8798223f009e94f634f6548d8653ab6d264",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:38:07Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e@sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:fb8c3a2aab49f9978035692b2af711f712775a053841a771f349d5dd59a3cbd1\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:37:35Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:077b94c3857e6e4077489116df0e7839fedea251cdfdc349e758c04e7123f0e5=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gh-multi-compon58ebf296a7d6d3f322b32bcaa94753e6-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/commit_sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dpevdh",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769/records/9cd76446-1c43-4bf6-9d34-3269a735c200",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"93439bead5fdc5b0825565724621d742755e312f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-91cf7322fc4ebbab4601024e235725b4-6cbd6af8f80b0777-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:36:53Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRunUID": "02506fd4-2a27-4c99-93ad-42213701e769",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "03052f006b5c7c771657e1d07d1e95f6876a8761a97121114e9d445b86a341"
                },
                "name": "gh-multi-compon8bf383d4fba5bc88174358ac96f4e0f6-build-container",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                        "uid": "02506fd4-2a27-4c99-93ad-42213701e769"
                    }
                ],
                "resourceVersion": "79945",
                "uid": "9cd76446-1c43-4bf6-9d34-3269a735c200"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "93439bead5fdc5b0825565724621d742755e312f"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:41:55Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:41:55Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compon8bf383d4fba5370004300c84a422444d31531587c6c5-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:0885ce29ca0eb8ac40593fd5c4d2dc649b69f42ffb6d5728765cfed9ab80985c"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-91cf7322fc4ebbab4601024e235725b4-6cbd6af8f80b0777-01"
                },
                "startTime": "2026-05-07T23:36:55Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1c4c7364a2f59b76dd69e610fd089bf7335367a9dc7fa38aa47b15011a244e04",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:37:36Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:37:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://af7b0df5bed53ae866b3e9283b1463da5807866b11f856eea7b0d9145031cf17",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:39:03Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:37:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a758202d257499466fe4a891f0638becf216b1e8b52209b04829d935ec02212c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:40:46Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:39:03Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://23812ed93adad1a467c8d785ad506a1851d160a225570bcac9554e8df52922e5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:05Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:40:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fb706bf305fb41d1e475bcf8c033d5b2cc1b7fe47c7f61d5719a504532a3d60f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:27Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:05Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0e548521fa28eeeef79f7b387b0856a36fa0af763344fa41a0b1837461b37a7d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:55Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f@sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:0885ce29ca0eb8ac40593fd5c4d2dc649b69f42ffb6d5728765cfed9ab80985c\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:28Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:4fe55866fb3cf3a23cf8d84711a1f56ee0afafa3c450390d1f0973ad1af3fd8e=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "93439bead5fdc5b0825565724621d742755e312f"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gh-multi-compon8bf383d4fba5bc88174358ac96f4e0f6-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/commit_sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dpevdh",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769/records/1e5de0ec-8898-45a6-b340-f01419dea4c7",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"93439bead5fdc5b0825565724621d742755e312f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-91cf7322fc4ebbab4601024e235725b4-5681b722953fef3b-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:42:06Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRunUID": "02506fd4-2a27-4c99-93ad-42213701e769",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min",
                    "test.appstudio.openshift.io/pr-group-sha": "03052f006b5c7c771657e1d07d1e95f6876a8761a97121114e9d445b86a341"
                },
                "name": "gh-multi-component-8bf383d4fba5bc88174358ac96f4e0f6-clamav-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                        "uid": "02506fd4-2a27-4c99-93ad-42213701e769"
                    }
                ],
                "resourceVersion": "85866",
                "uid": "1e5de0ec-8898-45a6-b340-f01419dea4c7"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:43:35Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:43:35Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-8bf383d40ad29f79afafb242b2fe7abd35a243c4-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\", \"digests\": [\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197408\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-91cf7322fc4ebbab4601024e235725b4-5681b722953fef3b-01"
                },
                "startTime": "2026-05-07T23:42:06Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:1093f897c407e60cfcee4e4c0ae43189c30a8a2b6a03d940487de8e7e1f5fb9b",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3b49e83748076496adccc32667c0eb2dcf0183b69014b794499bc6aea8d94c89",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:34Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\\\", \\\"digests\\\": [\\\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197408\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://edb03edd5ce06f5f3717233a6852b86ba8d6f07d94a6b97cb56d772768b32150",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:34Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\\\", \\\"digests\\\": [\\\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197408\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:29Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/commit_sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zamzpm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a/records/ece360a3-a2cb-4d35-921f-402adff671a7",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b111cfc751770a2eb5313cc86b3979b3-9fa1c6e9f5df6b18-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:42:12Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRunUID": "4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb-clamav-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                        "uid": "4a282620-c0a2-43db-8944-5ab0ca68119a"
                    }
                ],
                "resourceVersion": "85857",
                "uid": "ece360a3-a2cb-4d35-921f-402adff671a7"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:43:35Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:43:35Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpb9b38e8b1ecc72ace7bb962df8499d92-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\", \"digests\": [\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197409\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-b111cfc751770a2eb5313cc86b3979b3-9fa1c6e9f5df6b18-01"
                },
                "startTime": "2026-05-07T23:42:13Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:1093f897c407e60cfcee4e4c0ae43189c30a8a2b6a03d940487de8e7e1f5fb9b",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cdd7fb2ac3c88e1c84fdd3fe6fc2da25623b147ecd85a9a8a8464df85a09cd6e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:34Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\\\", \\\"digests\\\": [\\\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197409\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:24Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://293bf7c6d1734f452212bce17c8bbb9b58cd7f8c8d49565d682a2a7f1966c334",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:34Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\\\", \\\"digests\\\": [\\\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197409\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:29Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/commit_sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zamzpm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a/records/660d0821-0e16-4665-a4bc-3c5ccf0afbab",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b111cfc751770a2eb5313cc86b3979b3-69c5b5bf0e2ed900-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:34:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRunUID": "4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb-init",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                        "uid": "4a282620-c0a2-43db-8944-5ab0ca68119a"
                    }
                ],
                "resourceVersion": "62143",
                "uid": "660d0821-0e16-4665-a4bc-3c5ccf0afbab"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:34:26Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:34:26Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpgn-on-pull-request-pk2bb-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-b111cfc751770a2eb5313cc86b3979b3-69c5b5bf0e2ed900-01"
                },
                "startTime": "2026-05-07T23:34:17Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dd12f6cb0a7ed4a96d23e2132ff539105fc954a1c296a3214b557f5772e1eb2a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:34:25Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:34:25Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/commit_sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zamzpm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a/records/371a45bc-c52f-4c81-8d06-0527a2f58604",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"7e92c9e934ecdd9be6dbfc28e67833c265fb401e\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b111cfc751770a2eb5313cc86b3979b3-4579e8c3fb339352-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:42:14Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927565693",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "7e92c9e934ecdd9be6dbfc28e67833c265fb401e",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                    "tekton.dev/pipelineRunUID": "4a282620-c0a2-43db-8944-5ab0ca68119a",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb-tpa-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-pk2bb",
                        "uid": "4a282620-c0a2-43db-8944-5ab0ca68119a"
                    }
                ],
                "resourceVersion": "83690",
                "uid": "371a45bc-c52f-4c81-8d06-0527a2f58604"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:42:56Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:42:56Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vp68eed0cdce6ae4a115ff3843322d102b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\", \"digests\": [\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\":\"sha256:0d11d654968016604380151685668056a4a0345f209ae9cd9b46b7a2cfbd16d5\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":46,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:42:55+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-b111cfc751770a2eb5313cc86b3979b3-4579e8c3fb339352-01"
                },
                "startTime": "2026-05-07T23:42:14Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ef5ce550e65bcec5b90a81fa8bc70432278fdaca05c3bd4a82aed6d7a840b574",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:47Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:44Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e0bfbd19cef40eb44159a1112820c15cf8c8a9a340237ace587c8ec2eba5b959",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b2c0f2ff0095d1ecdf7dfca977e813ae5c33a3c52f5c71a5ad41ed5466384a99",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:55Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e\\\", \\\"digests\\\": [\\\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e\\\":\\\"sha256:0d11d654968016604380151685668056a4a0345f209ae9cd9b46b7a2cfbd16d5\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":46,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:42:55+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:7d367e9104a335b1a88a601895f098457ff3133daf6f6c3b9f0af557f4bd097e"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-7e92c9e934ecdd9be6dbfc28e67833c265fb401e"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/commit_sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wlqyyr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b/records/ac8cdd7e-fd32-469d-9b41-7bcab4da4d1c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-cb1cd650ce2d918c3906351e721fa882-d46def435a3391b4-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:47:51Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRunUID": "205bfe99-6331-4308-b533-c79b03e92d2b",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg-clamav-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                        "uid": "205bfe99-6331-4308-b533-c79b03e92d2b"
                    }
                ],
                "resourceVersion": "104738",
                "uid": "ac8cdd7e-fd32-469d-9b41-7bcab4da4d1c"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:49:04Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:49:04Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vp1a471f6a4f603c5cf547cc7ec8fe5f2b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\", \"digests\": [\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197740\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-cb1cd650ce2d918c3906351e721fa882-d46def435a3391b4-01"
                },
                "startTime": "2026-05-07T23:47:51Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:1093f897c407e60cfcee4e4c0ae43189c30a8a2b6a03d940487de8e7e1f5fb9b",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://823756af6afe073186c0b349c7bf3b68d11a9554ce41bb9808cb63e72eeee092",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:49:00Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\\\", \\\"digests\\\": [\\\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197740\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://161c92b20dbd4d7aa0e6acf0ddda6ecdf399828384c15cfb9c927d3ca5756514",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:49:04Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\\\", \\\"digests\\\": [\\\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197740\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:49:01Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/commit_sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wlqyyr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b/records/c2dcad3c-0b10-414c-8bbe-cdd0d38e9720",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-cb1cd650ce2d918c3906351e721fa882-f20af300e96a3bb1-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:43:58Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRunUID": "205bfe99-6331-4308-b533-c79b03e92d2b",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg-init",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                        "uid": "205bfe99-6331-4308-b533-c79b03e92d2b"
                    }
                ],
                "resourceVersion": "87464",
                "uid": "c2dcad3c-0b10-414c-8bbe-cdd0d38e9720"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:44:02Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:44:02Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpgn-on-pull-request-xkbmg-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-cb1cd650ce2d918c3906351e721fa882-f20af300e96a3bb1-01"
                },
                "startTime": "2026-05-07T23:43:58Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a0270d4687a350eea33ddc893d98409e72f049dc36f6f14053be87e22422a10a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:01Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:01Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/commit_sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wlqyyr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b/records/9907dae1-8c26-4548-a852-d15464a224dd",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-cb1cd650ce2d918c3906351e721fa882-77dc7b165553e965-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:47:51Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRunUID": "205bfe99-6331-4308-b533-c79b03e92d2b",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg-tpa-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                        "uid": "205bfe99-6331-4308-b533-c79b03e92d2b"
                    }
                ],
                "resourceVersion": "100291",
                "uid": "9907dae1-8c26-4548-a852-d15464a224dd"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:16Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:16Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpb6a05e91e6ef93113e07a93f02ab411f-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\", \"digests\": [\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\":\"sha256:451e65660b3f2d064bc6045baaa28de492a148b97fa44e63f7e9eac45f5213f3\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":46,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:15+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-cb1cd650ce2d918c3906351e721fa882-77dc7b165553e965-01"
                },
                "startTime": "2026-05-07T23:47:52Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3bdf62e34a01d4a0cffa9f999b6945ab2ce26e79a986db5328e14aa1b73332dc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:05Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7c370351b9205d1ecba5a3321b8647067e09da9b98f1e8a43cdce28895b60b95",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:09Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://61e4f6b3878adba4145fa501ff7a096f20cd838b8161f760bbb0a2fceeefaf06",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:15Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\\\", \\\"digests\\\": [\\\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\\\":\\\"sha256:451e65660b3f2d064bc6045baaa28de492a148b97fa44e63f7e9eac45f5213f3\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":46,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:15+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:10Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/commit_sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vhjudv",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-4dhlx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nRHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1/records/e259cd73-c320-41ca-ad3f-58687bbde1a9",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bfaf542f7e69e5381facc273838160b8-cb0ecff957344b24-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:45:34Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRunUID": "75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min"
                },
                "name": "gh-multi-component-child-vpgn-on-push-4dhlx-build-container",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-4dhlx",
                        "uid": "75d2a0cc-fd61-4020-9958-3a2c65125ca1"
                    }
                ],
                "resourceVersion": "100187",
                "uid": "e259cd73-c320-41ca-ad3f-58687bbde1a9"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "c76f390540c1df0efbd12a957f0c384f7a606149"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:11Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:11Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpgn-on-push-4dhlx-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:9b16f1c7e8d1bd2d4acbdb22b8c56149a13e22c2ff14169a11d43ecb8f5544d4"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bfaf542f7e69e5381facc273838160b8-cb0ecff957344b24-01"
                },
                "startTime": "2026-05-07T23:45:34Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://49791b1d9efb008c74c08c01c3acdd2feffd3cfae1f80b48e79a1f9d5f97395f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:40Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:40Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c31f4dd71b479ac1280eab94dcadfcb170815b6aa86843736d0d3c75f5486772",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:56Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7e1e9ce222f52d8f3c3d082ce4c263c91bb8a62c1711e61914511191e57f7a28",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:46:37Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b7aea6f9e9c96a47e97468026d4806f5f1b1f5c95a5c53840c59c09e478f1a89",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:00Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:46:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b1efab976d277fdbbc271ed3d163c5993a56f2a39588a8687323ad9402f998ca",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:34Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://42e3ab254ac06249a2a67b61aab0d5a4d14d463927525d2a76d83fea951c8ffd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:10Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:9b16f1c7e8d1bd2d4acbdb22b8c56149a13e22c2ff14169a11d43ecb8f5544d4\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:35Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "c76f390540c1df0efbd12a957f0c384f7a606149"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gh-multi-component-child-vpgn-on-push-4dhlx-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/commit_sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vhjudv",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-4dhlx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nRHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1/records/86101cd3-1d5d-4f4b-b784-9b8c3bcbcc60",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bfaf542f7e69e5381facc273838160b8-381ef7e1af5cc00b-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:48:12Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRunUID": "75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min"
                },
                "name": "gh-multi-component-child-vpgn-on-push-4dhlx-build-image-index",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-4dhlx",
                        "uid": "75d2a0cc-fd61-4020-9958-3a2c65125ca1"
                    }
                ],
                "resourceVersion": "101780",
                "uid": "86101cd3-1d5d-4f4b-b784-9b8c3bcbcc60"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:28Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:28Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vp74ca7aa1b82f4b50dcf747ab8e3d4990-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bfaf542f7e69e5381facc273838160b8-381ef7e1af5cc00b-01"
                },
                "startTime": "2026-05-07T23:48:12Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a0bf70539778c10838ddd2b2c8fd75b517aa98b69a9386bea0beef4308aee2aa",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:24Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://183e4b6554096cbf29e0cd47363ededecfee0cbe47ab0394cee2958ea1655264",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:25Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:25Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://54b3c8385ddd34632190f7b2f0a82dce7a7dbcdb09bbb79b47af3990fa9d0c61",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:27Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:25Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149@sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gh-multi-component-child-vpgn-on-push-4dhlx-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/commit_sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vhjudv",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-4dhlx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nRHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1/records/b084945f-c28f-434e-ad68-e14e9171b3e6",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bfaf542f7e69e5381facc273838160b8-b33678f95e3d87fc-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:48:28Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRunUID": "75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min"
                },
                "name": "gh-multi-component-child-vpgn-on-push-4dhlx-clamav-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-4dhlx",
                        "uid": "75d2a0cc-fd61-4020-9958-3a2c65125ca1"
                    }
                ],
                "resourceVersion": "102108",
                "uid": "b084945f-c28f-434e-ad68-e14e9171b3e6"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "completionTime": "2026-05-07T23:48:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:34Z",
                        "message": "the step \"extract-and-scan-image\" in TaskRun \"gh-multi-component-child-vpgn-on-push-4dhlx-clamav-scan\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/clamav-db:latest\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpgn-on-push-4dhlx-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "spanContext": {
                    "traceparent": "00-bfaf542f7e69e5381facc273838160b8-b33678f95e3d87fc-01"
                },
                "startTime": "2026-05-07T23:48:28Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:48:34Z",
                            "message": "Step extract-and-scan-image terminated as pod gh-multi-component-child-vpgn-on-push-4dhlx-clamav-scan-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:48:28Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:48:34Z",
                            "message": "Step upload terminated as pod gh-multi-component-child-vpgn-on-push-4dhlx-clamav-scan-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:48:32Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/commit_sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vhjudv",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-4dhlx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nRHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1/records/d78288e9-35b6-4176-8399-41c38e72b694",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bfaf542f7e69e5381facc273838160b8-f4f7eb70b686d58b-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:44:03Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRunUID": "75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min"
                },
                "name": "gh-multi-component-child-vpgn-on-push-4dhlx-clone-repository",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-4dhlx",
                        "uid": "75d2a0cc-fd61-4020-9958-3a2c65125ca1"
                    }
                ],
                "resourceVersion": "89603",
                "uid": "d78288e9-35b6-4176-8399-41c38e72b694"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "revision",
                        "value": "c76f390540c1df0efbd12a957f0c384f7a606149"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-vhjudv"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:44:43Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:44:43Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vp587633bdc562b2706d33db8ce1c37146-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "c76f390540c1df0efbd12a957f0c384f7a606149"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "c76f390540c1df0efbd12a957f0c384f7a606149"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778197424"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "c76f390"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bfaf542f7e69e5381facc273838160b8-f4f7eb70b686d58b-01"
                },
                "startTime": "2026-05-07T23:44:03Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://13b412995781a49379d82602ba202f624a51bc7dcbf983b0a634315a90d69637",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:40Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1},{\"key\":\"commit\",\"value\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197424\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"c76f390\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c4a7aec2916c90d00b4cc7bd7fa5aae592eb9a43b5cf40d404cf934ba447fb04",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:41Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1},{\"key\":\"commit\",\"value\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197424\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"c76f390\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dac08d630662a4cd79a5e5d034e6e59af393addd2f22603e1dcaaf4977d12758",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:42Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78\",\"type\":1},{\"key\":\"commit\",\"value\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197424\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"c76f390\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:41Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "c76f390540c1df0efbd12a957f0c384f7a606149"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/commit_sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vhjudv",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-4dhlx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nRHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1/records/f6dbfb47-d289-4dfb-80d5-05db72b8ac2d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bfaf542f7e69e5381facc273838160b8-4d7a2c016c051315-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:43:57Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRunUID": "75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init"
                },
                "name": "gh-multi-component-child-vpgn-on-push-4dhlx-init",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-4dhlx",
                        "uid": "75d2a0cc-fd61-4020-9958-3a2c65125ca1"
                    }
                ],
                "resourceVersion": "87468",
                "uid": "f6dbfb47-d289-4dfb-80d5-05db72b8ac2d"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:44:02Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:44:02Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpgn-on-push-4dhlx-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bfaf542f7e69e5381facc273838160b8-4d7a2c016c051315-01"
                },
                "startTime": "2026-05-07T23:43:57Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e2e698c3378f1edb5592cb8fc7218cfcd479537d5e74a523b92edddfc83efe65",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:01Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:01Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/commit_sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vhjudv",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-4dhlx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nRHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1/records/6992899e-70a0-42fd-a097-31a666862e6e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bfaf542f7e69e5381facc273838160b8-05a2f4d5426de9be-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:48:29Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRunUID": "75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan"
                },
                "name": "gh-multi-component-child-vpgn-on-push-4dhlx-rpms-signature-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-4dhlx",
                        "uid": "75d2a0cc-fd61-4020-9958-3a2c65125ca1"
                    }
                ],
                "resourceVersion": "103668",
                "uid": "6992899e-70a0-42fd-a097-31a666862e6e"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:45Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:45Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpbac322c3fd925b47afa52201b9e7419b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149\", \"digests\": [\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:44+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bfaf542f7e69e5381facc273838160b8-05a2f4d5426de9be-01"
                },
                "startTime": "2026-05-07T23:48:30Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9ed9242b3566700d89d089874077379f97a1b32fa1ea098bb8d804ca538d6517",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:44Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e909d429aef7ce4b6624ce72a046a8b7716d2eaefc0ee9cbad68c22f445e01c6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:44Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149\\\", \\\"digests\\\": [\\\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:44+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:44Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/commit_sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vhjudv",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-4dhlx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nRHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1/records/77d3c966-bd09-434f-ab79-f147d8930f59",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bfaf542f7e69e5381facc273838160b8-d2754e338a59f954-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:48:28Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRunUID": "75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min"
                },
                "name": "gh-multi-component-child-vpgn-on-push-4dhlx-sast-shell-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-4dhlx",
                        "uid": "75d2a0cc-fd61-4020-9958-3a2c65125ca1"
                    }
                ],
                "resourceVersion": "104533",
                "uid": "77d3c966-bd09-434f-ab79-f147d8930f59"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "completionTime": "2026-05-07T23:48:55Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:55Z",
                        "message": "the step \"upload\" in TaskRun \"gh-multi-component-child-vpgn-on-push-4dhlx-sast-shell-check\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpbb6242cfde94babbfa4151412d979ae4-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "spanContext": {
                    "traceparent": "00-bfaf542f7e69e5381facc273838160b8-d2754e338a59f954-01"
                },
                "startTime": "2026-05-07T23:48:28Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:48:55Z",
                            "message": "Step use-trusted-artifact terminated as pod gh-multi-component-child-vpbb6242cfde94babbfa4151412d979ae4-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:48:33Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:48:55Z",
                            "message": "Step sast-shell-check terminated as pod gh-multi-component-child-vpbb6242cfde94babbfa4151412d979ae4-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:48:33Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-upload",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:48:55Z",
                            "message": "Step upload terminated as pod gh-multi-component-child-vpbb6242cfde94babbfa4151412d979ae4-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:48:28Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/commit_sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vhjudv",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-4dhlx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nRHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1/records/c7825ddc-0fee-446f-9854-c454d095b146",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bfaf542f7e69e5381facc273838160b8-8c479cfe661c0350-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:48:29Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRunUID": "75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min"
                },
                "name": "gh-multi-component-child-vpgn-on-push-4dhlx-sast-unicode-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-4dhlx",
                        "uid": "75d2a0cc-fd61-4020-9958-3a2c65125ca1"
                    }
                ],
                "resourceVersion": "102470",
                "uid": "c7825ddc-0fee-446f-9854-c454d095b146"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:37Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:37Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vp84e2e7985e1e4e5685b12160e9ac9f54-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:35+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bfaf542f7e69e5381facc273838160b8-8c479cfe661c0350-01"
                },
                "startTime": "2026-05-07T23:48:29Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3d220d3b828acd77f5b84207a9653cfcb206b9e7e6f7657c2ee42fcd3590c355",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:34Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0148c153f10da0a3cf8ac89eb4bd9cfac48fbc42d99e41eedc6a4712b64156ea",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:35Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:35+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9720bad8910894c3fc9c2995bdc3336b16e59e3c26876c0022df2b2ee9c00310",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:37Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:35+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:36Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/commit_sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vhjudv",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-4dhlx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nRHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1/records/c4e20468-ff86-496d-86a0-98e14e1654ee",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bfaf542f7e69e5381facc273838160b8-9459eb8cea8c0daa-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:48:29Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRunUID": "75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan"
                },
                "name": "gh-multi-component-child-vpgn-on-push-4dhlx-tpa-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-4dhlx",
                        "uid": "75d2a0cc-fd61-4020-9958-3a2c65125ca1"
                    }
                ],
                "resourceVersion": "109079",
                "uid": "c4e20468-ff86-496d-86a0-98e14e1654ee"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:51:03Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:51:03Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpgn-on-push-4dhlx-tpa-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149\", \"digests\": [\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\":\"sha256:4e75446523a32b15611905ccaf42307151cd8b70317d834b8365a40d95301990\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":46,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:51:02+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bfaf542f7e69e5381facc273838160b8-9459eb8cea8c0daa-01"
                },
                "startTime": "2026-05-07T23:48:29Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d7e4cfbf6adbe95e49d5e6d256d973ccb6fc1f599404cd5b8f063475233ec9ce",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:50:55Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:39Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://88831a7b3e4eee9a6f09808218920d07c07e444bf8d35e46825b664174ef2ec9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:50:58Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:50:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5bf17978097b94c310c89701b3161f0323019d8dafc5a4ef5a54c4b2682f4d74",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:51:03Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149\\\", \\\"digests\\\": [\\\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2\\\":\\\"sha256:4e75446523a32b15611905ccaf42307151cd8b70317d834b8365a40d95301990\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":46,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:51:02+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:50:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:84e90997526394f43938026af76960de05c233dfb54080a82e3194228689bae2"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/commit_sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-doqzna",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-sjq7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31/records/88be0a81-81ed-4b63-88a0-24bb27971400",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"eventType\":\"push\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5359416df3724cd31f790fce09404dbe-63c5f280dccf6986-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:45:08Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRunUID": "830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min"
                },
                "name": "gh-multi-component-child-vpgn-on-push-sjq7v-build-container",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-sjq7v",
                        "uid": "830038fa-c26b-4b1f-8d7b-e7071a748e31"
                    }
                ],
                "resourceVersion": "97801",
                "uid": "88be0a81-81ed-4b63-88a0-24bb27971400"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:47:44Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:47:44Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpgn-on-push-sjq7v-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:3efca804fcc5c4caa24c101541910b7f093233b25a0ceebfcbfc3c432846ebea"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5359416df3724cd31f790fce09404dbe-63c5f280dccf6986-01"
                },
                "startTime": "2026-05-07T23:45:09Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f6c74a65b4b28104cfa00ec3ccbcfd0fa994f0445d4888b31d845524bd18a364",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:14Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:14Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6c4e448fa3c58fd3cf916b6fa355580f0dec458144630ed5284301a444db2484",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:46:00Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f9ad2e5a8ba193446a4ed7500373298362a517fb1b01411a2c288672cd155b53",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:46:37Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:46:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://94a617c95fb34ebe1d198d08853f8d1ed40716b761506176648e8b33f4a17d84",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:46:55Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:46:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://09df0947563212bbef4a286b42dec4fa7c317d99e4662460a6221aa5e9451d67",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:19Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:46:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a6d737e99d20ce15ddc83562cf846494e48e6b4935971e04ffbfddd36cf66455",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:43Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:3efca804fcc5c4caa24c101541910b7f093233b25a0ceebfcbfc3c432846ebea\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:19Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "2e75539aa24a12a01a652e3d4a7d20b15b538197"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gh-multi-component-child-vpgn-on-push-sjq7v-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/commit_sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-doqzna",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-sjq7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31/records/91d0dd8a-31f5-48e9-8378-966e52cd9e8e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"eventType\":\"push\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5359416df3724cd31f790fce09404dbe-57189114fe955907-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:44Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRunUID": "830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "tekton.dev/pipelineTask": "build-image-index"
                },
                "name": "gh-multi-component-child-vpgn-on-push-sjq7v-build-image-index",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-sjq7v",
                        "uid": "830038fa-c26b-4b1f-8d7b-e7071a748e31"
                    }
                ],
                "resourceVersion": "98882",
                "uid": "91d0dd8a-31f5-48e9-8378-966e52cd9e8e"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:47:57Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:47:57Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpa15eb8389d78b5bb749dff8652c114a6-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5359416df3724cd31f790fce09404dbe-57189114fe955907-01"
                },
                "startTime": "2026-05-07T23:47:44Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dce4f6fcce62c74ae57768195edbde434c3da036533218f62bcd7e770b0b5988",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:52Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bf2ea6a116f5d7171f4a066b2d213a1fd35fdb6dce5221ca87f579d567ce18a1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:53Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7039f3ee627e9ee898e80ad3b284bb4ff9fbc70bd69ff32a1f59d88b1bd5a23a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:56Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:53Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197@sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gh-multi-component-child-vpgn-on-push-sjq7v-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/commit_sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-doqzna",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-sjq7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31/records/01a48599-45ee-4a2d-9584-4efc1042ef6e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"eventType\":\"push\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5359416df3724cd31f790fce09404dbe-f7749b2c41d17eec-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:57Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRunUID": "830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min"
                },
                "name": "gh-multi-component-child-vpgn-on-push-sjq7v-clamav-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-sjq7v",
                        "uid": "830038fa-c26b-4b1f-8d7b-e7071a748e31"
                    }
                ],
                "resourceVersion": "103669",
                "uid": "01a48599-45ee-4a2d-9584-4efc1042ef6e"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:45Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:45Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpgn-on-push-sjq7v-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"ERROR\",\"timestamp\":\"2026-05-07T23:48:43+00:00\",\"note\":\"Unexpected error: Script errored at command: return \\\"${status}\\\".\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5359416df3724cd31f790fce09404dbe-f7749b2c41d17eec-01"
                },
                "startTime": "2026-05-07T23:47:57Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:1093f897c407e60cfcee4e4c0ae43189c30a8a2b6a03d940487de8e7e1f5fb9b",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://622c10bcfbfa1aabfb646fbca88b7ad9fa8f135b3ca5bfef25a601192e35a407",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:43Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:43+00:00\\\",\\\"note\\\":\\\"Unexpected error: Script errored at command: return \\\\\\\"${status}\\\\\\\".\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ecd80ff8afc6dc2c3656a79f504c068541ba5a4238043ce1d25e883107f74ea4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:44Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:43+00:00\\\",\\\"note\\\":\\\"Unexpected error: Script errored at command: return \\\\\\\"${status}\\\\\\\".\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:44Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/commit_sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-doqzna",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-sjq7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31/records/1fec6424-e001-4178-a619-f7aede2af28e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"eventType\":\"push\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5359416df3724cd31f790fce09404dbe-0ccfc8807876df11-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:44:05Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRunUID": "830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min"
                },
                "name": "gh-multi-component-child-vpgn-on-push-sjq7v-clone-repository",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-sjq7v",
                        "uid": "830038fa-c26b-4b1f-8d7b-e7071a748e31"
                    }
                ],
                "resourceVersion": "88359",
                "uid": "1fec6424-e001-4178-a619-f7aede2af28e"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "revision",
                        "value": "2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-doqzna"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:44:16Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:44:16Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vp5386028fba1dd66a2f789b97da084ebe-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778197429"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "2e75539"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5359416df3724cd31f790fce09404dbe-0ccfc8807876df11-01"
                },
                "startTime": "2026-05-07T23:44:05Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4d6cd5dc720bb74e475cefbcd4c811eb633fc6980af491e9af22e4f663d4d30d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:09Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1},{\"key\":\"commit\",\"value\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197429\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"2e75539\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:09Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b3ab401ce4a0a2d4dc3ed61e0b2a1f6f3dc9700009eb645f61dc4dd6eaf4dbcb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:10Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1},{\"key\":\"commit\",\"value\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197429\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"2e75539\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3a866eac8f684a323588035931ff6a050c6bd8ce739011bd57701d523cce8551",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:16Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f\",\"type\":1},{\"key\":\"commit\",\"value\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197429\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"2e75539\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:10Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "2e75539aa24a12a01a652e3d4a7d20b15b538197"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/commit_sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-doqzna",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-sjq7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31/records/9788b41e-75a7-4ff9-8a69-1e6d1ac3fff8",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"eventType\":\"push\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5359416df3724cd31f790fce09404dbe-d480fe69040fc005-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:43:59Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRunUID": "830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "tekton.dev/pipelineTask": "init"
                },
                "name": "gh-multi-component-child-vpgn-on-push-sjq7v-init",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-sjq7v",
                        "uid": "830038fa-c26b-4b1f-8d7b-e7071a748e31"
                    }
                ],
                "resourceVersion": "87626",
                "uid": "9788b41e-75a7-4ff9-8a69-1e6d1ac3fff8"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:44:04Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:44:04Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpgn-on-push-sjq7v-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5359416df3724cd31f790fce09404dbe-d480fe69040fc005-01"
                },
                "startTime": "2026-05-07T23:43:59Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5c119255e6b7b1a4e3c68dabdb83c820feb17ba396096019069863048e188945",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:03Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:03Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/commit_sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-doqzna",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-sjq7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31/records/2f405b54-d0f3-4393-891b-18906543bba6",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"eventType\":\"push\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5359416df3724cd31f790fce09404dbe-2c0e2a413e356388-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:57Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRunUID": "830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan"
                },
                "name": "gh-multi-component-child-vpgn-on-push-sjq7v-rpms-signature-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-sjq7v",
                        "uid": "830038fa-c26b-4b1f-8d7b-e7071a748e31"
                    }
                ],
                "resourceVersion": "100265",
                "uid": "2f405b54-d0f3-4393-891b-18906543bba6"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:16Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:16Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vp86f0e1db7daddd7c33f62811191adaac-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197\", \"digests\": [\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:16+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5359416df3724cd31f790fce09404dbe-2c0e2a413e356388-01"
                },
                "startTime": "2026-05-07T23:47:57Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f731f7bf8e13705e6e9e0b62ee8c3cf7a473e8816db19001a890015ba3bac953",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:15Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:03Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://84fc1fb09fbafac930262f8cab56796ab354281d3f43bd455998c46493b878b8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:16Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197\\\", \\\"digests\\\": [\\\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:16+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:15Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/commit_sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-doqzna",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-sjq7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31/records/53d8d9cc-f364-4811-b97d-3cf2510608ca",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"eventType\":\"push\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5359416df3724cd31f790fce09404dbe-f38a8cfe09676310-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:57Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRunUID": "830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min"
                },
                "name": "gh-multi-component-child-vpgn-on-push-sjq7v-sast-shell-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-sjq7v",
                        "uid": "830038fa-c26b-4b1f-8d7b-e7071a748e31"
                    }
                ],
                "resourceVersion": "100370",
                "uid": "53d8d9cc-f364-4811-b97d-3cf2510608ca"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:20Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:20Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vp6394a2fcea43fc4044451cc5d0fcdda9-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:18+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5359416df3724cd31f790fce09404dbe-f38a8cfe09676310-01"
                },
                "startTime": "2026-05-07T23:47:58Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://255641e2a3623948bc2a8313f2c1cae6d376f78c5d5043ea94f610538805a7bd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:02Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2e97802367f3f4f3dcafc7bd0303c43d16f6289fd85ff83940237761ba5406ea",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:18Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:18+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:03Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2ca166b6c86cdce4cad90afae11849622c74b7340c772560f29af35cfad22da3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:19Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:18+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:18Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/commit_sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-doqzna",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-sjq7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31/records/c842120d-0fca-4489-a969-02e2f562b7d2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"eventType\":\"push\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5359416df3724cd31f790fce09404dbe-907fc58d83ec2de6-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:57Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRunUID": "830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min"
                },
                "name": "gh-multi-component-child-vpgn-on-push-sjq7v-sast-unicode-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-sjq7v",
                        "uid": "830038fa-c26b-4b1f-8d7b-e7071a748e31"
                    }
                ],
                "resourceVersion": "100131",
                "uid": "c842120d-0fca-4489-a969-02e2f562b7d2"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:14Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpf468e7ade97f533d60b4e37023d847f1-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:08+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5359416df3724cd31f790fce09404dbe-907fc58d83ec2de6-01"
                },
                "startTime": "2026-05-07T23:47:58Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://55dfab8fec67ee630b9ddb8dda94fa748a66dea4ae61fa0429542f30ba55e95e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:06Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b6612fa547b2b4493896bc3413c534e0077e94b98be9d336ec0e91735d076420",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:08Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:08+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e10cf001f65cdd7c095dbbfd4cec6f42f3492e2d5ce54476c32f7349bfb4a484",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:08+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:09Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/commit_sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-doqzna",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-sjq7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31/records/0a5507f7-8251-4863-84c0-683b4abb53de",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"eventType\":\"push\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5359416df3724cd31f790fce09404dbe-2851c12a862a3f79-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:57Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRunUID": "830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan"
                },
                "name": "gh-multi-component-child-vpgn-on-push-sjq7v-tpa-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-sjq7v",
                        "uid": "830038fa-c26b-4b1f-8d7b-e7071a748e31"
                    }
                ],
                "resourceVersion": "100132",
                "uid": "0a5507f7-8251-4863-84c0-683b4abb53de"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:13Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:13Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vpgn-on-push-sjq7v-tpa-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197\", \"digests\": [\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\":\"sha256:e1f040575c6dcb13e48e6ea56e53c9c431546a73c6b7202fe772c78746ff4cf5\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":46,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:13+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5359416df3724cd31f790fce09404dbe-2851c12a862a3f79-01"
                },
                "startTime": "2026-05-07T23:47:58Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6e4ebd75954a494518b330e57b20757cc9eb9e74d24cec91da79d01a07899718",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:04Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9879cfcc9b9e87719b3b4c458b456f5a6832a20f938c632c799666dcc3e57b89",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:07Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0615e4e2460476b8996899f88b5c421cfc8e8616550cbfdd67d2d5fd1665f4a0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:13Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197\\\", \\\"digests\\\": [\\\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c\\\":\\\"sha256:e1f040575c6dcb13e48e6ea56e53c9c431546a73c6b7202fe772c78746ff4cf5\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":46,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:13+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:08Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c6d4f156f8236907f682610f72a71d1c9b1a8b4bf4b4f23d6ecde7837edd2d4c"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/commit_sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dpevdh",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769/records/c066e419-ad70-4de2-8d67-a28c5a97928d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"93439bead5fdc5b0825565724621d742755e312f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-91cf7322fc4ebbab4601024e235725b4-bde0dc72fedb45c7-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:35:10Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRunUID": "02506fd4-2a27-4c99-93ad-42213701e769",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "03052f006b5c7c771657e1d07d1e95f6876a8761a97121114e9d445b86a341"
                },
                "name": "gh-multi-component-parent-vpgn-on-pull-request-g98zc-init",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                        "uid": "02506fd4-2a27-4c99-93ad-42213701e769"
                    }
                ],
                "resourceVersion": "65610",
                "uid": "c066e419-ad70-4de2-8d67-a28c5a97928d"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:35:18Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:35:18Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-vpgn-on-pull-request-g98zc-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-91cf7322fc4ebbab4601024e235725b4-bde0dc72fedb45c7-01"
                },
                "startTime": "2026-05-07T23:35:10Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://617273e457762f26b9a5ad46641ecd23e7944f966f3dacb84e074dea09b60049",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:18Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:17Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/commit_sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dpevdh",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769/records/915bf726-cf4e-4d49-be6b-f7a61d91cda3",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"93439bead5fdc5b0825565724621d742755e312f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/02506fd4-2a27-4c99-93ad-42213701e769",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-91cf7322fc4ebbab4601024e235725b4-dcd9308c1a750793-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:42:06Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927648275",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "93439bead5fdc5b0825565724621d742755e312f",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                    "tekton.dev/pipelineRunUID": "02506fd4-2a27-4c99-93ad-42213701e769",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "03052f006b5c7c771657e1d07d1e95f6876a8761a97121114e9d445b86a341"
                },
                "name": "gh-multi-component-parent-vpgn-on-pull-request-g98zc-tpa-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-pull-request-g98zc",
                        "uid": "02506fd4-2a27-4c99-93ad-42213701e769"
                    }
                ],
                "resourceVersion": "82541",
                "uid": "915bf726-cf4e-4d49-be6b-f7a61d91cda3"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:42:39Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:42:39Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-v26b0e39ee973ac99c5c56d313f3810f0-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\", \"digests\": [\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\":\"sha256:d02a079807a938d443b4f9370fc68561f95c4475b37bf7a8398d588aa82a7de3\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":4,\"high\":28,\"medium\":53,\"low\":9,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:42:38+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-91cf7322fc4ebbab4601024e235725b4-dcd9308c1a750793-01"
                },
                "startTime": "2026-05-07T23:42:06Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9273d916c07bcb136a7651e3e3b7be9a73bb2ac4f2a3ec0a43e2fc56786d1f8c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:28Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:26Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://05489d2c32cdce15bbc0ede20a8b22e2cb74dcdb0cf0e53bd9b62882cb340bec",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:36Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6b67a7890706bb6573f1348a38b510fb0971348bf15928b310135a08dd7cc886",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:38Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f\\\", \\\"digests\\\": [\\\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae\\\":\\\"sha256:d02a079807a938d443b4f9370fc68561f95c4475b37bf7a8398d588aa82a7de3\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":4,\\\"high\\\":28,\\\"medium\\\":53,\\\"low\\\":9,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:42:38+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:37Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:de04b71fd70715e586b9bfa356b71d55efacbde93791224bb732a5017fa042ae"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:on-pr-93439bead5fdc5b0825565724621d742755e312f"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/commit_sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vppbbl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-push-946q5",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vpgn\n\nRHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6/records/372ae879-20fa-4e2e-8b45-8c7ab0cc4387",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f832ae3bd81a47a989487368f6f58ffa-a115e932ebffbf35-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:45:06Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRunUID": "697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min"
                },
                "name": "gh-multi-component-parent-vpgn-on-push-946q5-build-container",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-push-946q5",
                        "uid": "697903ad-5b17-4ac8-af99-dcff3f958ea6"
                    }
                ],
                "resourceVersion": "97548",
                "uid": "372ae879-20fa-4e2e-8b45-8c7ab0cc4387"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:47:43Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:47:43Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-v15819c1e399156e8bb9e22c37e31e5ca-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:edbc1321bd8da82dd272b08c4ecaaaa21a4422d5968815356a041d3aae490bc6"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-f832ae3bd81a47a989487368f6f58ffa-a115e932ebffbf35-01"
                },
                "startTime": "2026-05-07T23:45:06Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1cd848b95ef294d9895691218fd8db5d6aedfc35d1dbb6fc561c4893103aea7e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:12Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9c183277dd78eedcca06df8e818a1ca0b1d4aa9e88b490cb4cd458e4684620b7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:46:06Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7b8d6d1145b4b800eaf2c9bcd74b0f88bd38030c3561009cd62be026872dd5bc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:46:43Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:46:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://de87b0143513697232479d8421ada2067cf6760a236036b4914ec734693f5da3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:00Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:46:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b29fca2d7b718652f45ed4cf9ad45dc0dc15f2da076f35e7c906d953ee3f6381",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:17Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e901ceb62a630f8f6869d9848ed05b9dbbc86cedcb01a5089cc08ea406e07ac4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:42Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:edbc1321bd8da82dd272b08c4ecaaaa21a4422d5968815356a041d3aae490bc6\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:18Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "c461699bd22ed21feec5ce2f8861b57fb68d7192"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gh-multi-component-parent-vpgn-on-push-946q5-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/commit_sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vppbbl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-push-946q5",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vpgn\n\nRHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6/records/aac43f1f-d922-40bc-b791-5652b2c494cf",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f832ae3bd81a47a989487368f6f58ffa-ab2f7e6fb8b2fbb2-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRunUID": "697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min"
                },
                "name": "gh-multi-component-parent-vpgn-on-push-946q5-build-image-index",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-push-946q5",
                        "uid": "697903ad-5b17-4ac8-af99-dcff3f958ea6"
                    }
                ],
                "resourceVersion": "98815",
                "uid": "aac43f1f-d922-40bc-b791-5652b2c494cf"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:47:56Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:47:56Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-vee32da09365c80020db74643c8c83294-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-f832ae3bd81a47a989487368f6f58ffa-ab2f7e6fb8b2fbb2-01"
                },
                "startTime": "2026-05-07T23:47:43Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://44a6f76c33525078b5106b9519082deeac6ce644aeb52087fce08672d0e2b61c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:51Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2c74f243bc540f5267a9b1b7bbbd6983990c0fc94b5bd44b5d46b44d7b344c05",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:52Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://412225495d48a5a2ea27dd284733b90939dcdec91738b0d91e7b311ad2d0d0bd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:54Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:52Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192@sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gh-multi-component-parent-vpgn-on-push-946q5-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/commit_sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vppbbl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-push-946q5",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vpgn\n\nRHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6/records/fe17d70b-1cf9-4a60-bb08-c96e8e19e9ee",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f832ae3bd81a47a989487368f6f58ffa-a6c389d3d9f3ee5d-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:56Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRunUID": "697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min"
                },
                "name": "gh-multi-component-parent-vpgn-on-push-946q5-clamav-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-push-946q5",
                        "uid": "697903ad-5b17-4ac8-af99-dcff3f958ea6"
                    }
                ],
                "resourceVersion": "105343",
                "uid": "fe17d70b-1cf9-4a60-bb08-c96e8e19e9ee"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:49:12Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:49:12Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-vpgn-on-push-946q5-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\", \"digests\": [\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197749\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-f832ae3bd81a47a989487368f6f58ffa-a6c389d3d9f3ee5d-01"
                },
                "startTime": "2026-05-07T23:47:56Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:1093f897c407e60cfcee4e4c0ae43189c30a8a2b6a03d940487de8e7e1f5fb9b",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4d9a746c147705159af9802d562197ffcb5145a278e4d2b1130ad8122060fcc8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:49:09Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\\\", \\\"digests\\\": [\\\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197749\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c88695b091066025fafe5bfed33bb8b1244eb215dd2a9ff9e608a3cabe910bd0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:49:12Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\\\", \\\"digests\\\": [\\\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197749\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:49:10Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/commit_sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vppbbl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-push-946q5",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vpgn\n\nRHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6/records/b61714d4-5ccc-4430-b6a0-2c903bc60bce",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f832ae3bd81a47a989487368f6f58ffa-0353415f82d20a40-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:44:07Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRunUID": "697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min"
                },
                "name": "gh-multi-component-parent-vpgn-on-push-946q5-clone-repository",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-push-946q5",
                        "uid": "697903ad-5b17-4ac8-af99-dcff3f958ea6"
                    }
                ],
                "resourceVersion": "88300",
                "uid": "b61714d4-5ccc-4430-b6a0-2c903bc60bce"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt"
                    },
                    {
                        "name": "revision",
                        "value": "c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-vppbbl"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:44:15Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:44:15Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-va52d430c5d36d46948dde8f4ac89a625-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778197431"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "c461699"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-f832ae3bd81a47a989487368f6f58ffa-0353415f82d20a40-01"
                },
                "startTime": "2026-05-07T23:44:07Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1a4cd30bd02e0de223e6c39553d246a789cd4154bf86fbeb55fb26a17aecd21c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:12Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt\",\"type\":1},{\"key\":\"commit\",\"value\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197431\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"c461699\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://35496c001e99f8117c842e7fa397083a7205a21854178b12effaf0fd98fd3435",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:13Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt\",\"type\":1},{\"key\":\"commit\",\"value\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197431\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"c461699\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2b312fec6fd1230a29a1616895fe370deecac6169d42cf0622fd3b60f49349fb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:14Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1\",\"type\":1},{\"key\":\"commit\",\"value\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197431\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"c461699\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:13Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "c461699bd22ed21feec5ce2f8861b57fb68d7192"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/commit_sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vppbbl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-push-946q5",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vpgn\n\nRHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6/records/c68613e7-2acc-4bf8-8de9-6dcdd52e59f6",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f832ae3bd81a47a989487368f6f58ffa-4175dd326258e16a-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:44:01Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRunUID": "697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init"
                },
                "name": "gh-multi-component-parent-vpgn-on-push-946q5-init",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-push-946q5",
                        "uid": "697903ad-5b17-4ac8-af99-dcff3f958ea6"
                    }
                ],
                "resourceVersion": "87837",
                "uid": "c68613e7-2acc-4bf8-8de9-6dcdd52e59f6"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:44:06Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:44:06Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-vpgn-on-push-946q5-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-f832ae3bd81a47a989487368f6f58ffa-4175dd326258e16a-01"
                },
                "startTime": "2026-05-07T23:44:01Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bd5b83db5a08c40b85df60f1304ea61c5864f5f8037f4cbdd310771885c18291",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:05Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:05Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/commit_sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vppbbl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-push-946q5",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vpgn\n\nRHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6/records/55d2bb6a-c548-4f59-8d86-a8a8988acb71",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f832ae3bd81a47a989487368f6f58ffa-a2df99fd4498c016-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:56Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRunUID": "697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min"
                },
                "name": "gh-multi-component-parent-vpgn-on-push-946q5-sast-shell-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-push-946q5",
                        "uid": "697903ad-5b17-4ac8-af99-dcff3f958ea6"
                    }
                ],
                "resourceVersion": "100372",
                "uid": "55d2bb6a-c548-4f59-8d86-a8a8988acb71"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:20Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:20Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-ve102d45acdb32ce0bb2037fca879ec23-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:18+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-f832ae3bd81a47a989487368f6f58ffa-a2df99fd4498c016-01"
                },
                "startTime": "2026-05-07T23:47:56Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0b25efe77c30fbd42fe25f27eeee49f18233001ed42e43acde944926c2743b03",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:02Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://97e60e628c56cdfebfdf9df80f244b0d55ea685b309cbdc668eab136fab55a13",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:18Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:18+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:03Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://546c222d0d93f1fea5758b405caf05869071be7e66f7dc7fd9b2c9c0b2774dc4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:20Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:18+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:18Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/commit_sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vppbbl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-push-946q5",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vpgn\n\nRHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6/records/f6a1d78a-2606-4cba-9bbb-f575074122a0",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f832ae3bd81a47a989487368f6f58ffa-51b92a9cc7af5c05-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:56Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRunUID": "697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min"
                },
                "name": "gh-multi-component-parent-vpgn-on-push-946q5-sast-unicode-check",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-push-946q5",
                        "uid": "697903ad-5b17-4ac8-af99-dcff3f958ea6"
                    }
                ],
                "resourceVersion": "99661",
                "uid": "f6a1d78a-2606-4cba-9bbb-f575074122a0"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:09Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:09Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-v5f439f1cf505ef19127e157a4e72b073-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:04+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-f832ae3bd81a47a989487368f6f58ffa-51b92a9cc7af5c05-01"
                },
                "startTime": "2026-05-07T23:47:56Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://86eaf98e2126325cb1d97049ddf3f909c3fac24a40e91f5054195c94b183c8a2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:02Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://644c87dad62d449278ad66afb1def24034c3fd7dfed92674b5a95a4a491c5985",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:04Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:04+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:03Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fb4314454c904835c36df1787a7473c61855665e5af3548c392075a168684865",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:08Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:04+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:04Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn@sha256:531f7408d096a49f1f59ba7ba5470b492b0c9add4edfc15f1b0561319ba150c1=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt?rev=c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/commit_sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vppbbl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vpgn-on-push-946q5",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vpgn\n\nRHTAP-Qe-App update gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt/commit/c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6/records/347a20f8-5c04-4fd2-b604-39b27ade0d67",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-zuzpjt\",\"commit\":\"c461699bd22ed21feec5ce2f8861b57fb68d7192\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f832ae3bd81a47a989487368f6f58ffa-d2e3e8a89fade47a-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:47:56Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928538914",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-parent-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "tekton.dev/pipelineRunUID": "697903ad-5b17-4ac8-af99-dcff3f958ea6",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan"
                },
                "name": "gh-multi-component-parent-vpgn-on-push-946q5-tpa-scan",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vpgn-on-push-946q5",
                        "uid": "697903ad-5b17-4ac8-af99-dcff3f958ea6"
                    }
                ],
                "resourceVersion": "99751",
                "uid": "347a20f8-5c04-4fd2-b604-39b27ade0d67"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:10Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:10Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-vpgn-on-push-946q5-tpa-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\", \"digests\": [\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\":\"sha256:017fcdfc5a590e8d006dad99ddb8edd3ff3dd1185826f55933514ce2ce2a36f2\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":4,\"high\":28,\"medium\":53,\"low\":9,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:09+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-f832ae3bd81a47a989487368f6f58ffa-d2e3e8a89fade47a-01"
                },
                "startTime": "2026-05-07T23:47:57Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0d6df8b58ed095b74acde4ad2e48d7a493d24cdeea5097e41155ab7c901dd105",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:03Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e68aa430e3e19fb47d6d9d8dbd30e5392fea8931ffbbc2b27cf09e667a901324",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:06Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://51e5a3058464e15343dc07a7043526b83f834fcbd5b393a959c9bfdbf50981c0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:09Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192\\\", \\\"digests\\\": [\\\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77\\\":\\\"sha256:017fcdfc5a590e8d006dad99ddb8edd3ff3dd1185826f55933514ce2ce2a36f2\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":4,\\\"high\\\":28,\\\"medium\\\":53,\\\"low\\\":9,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:09+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:07Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c06be0359da65da58c6d73e9843a245f4db1710582bebf07029f4ec13ffaaa77"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/commit_sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wlqyyr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b/records/34aa2fe1-1b73-4d54-9c67-b190f6c8541f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-cb1cd650ce2d918c3906351e721fa882-188cf3279c2b9ebe-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:45:03Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRunUID": "205bfe99-6331-4308-b533-c79b03e92d2b",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-componfa4e560be39b4c3206280eccf098219a-build-container",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                        "uid": "205bfe99-6331-4308-b533-c79b03e92d2b"
                    }
                ],
                "resourceVersion": "97344",
                "uid": "34aa2fe1-1b73-4d54-9c67-b190f6c8541f"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "554eb24cc796489c97912e7edff1125b39ecca22"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:47:39Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:47:39Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-componfa4e560be39bd8634d8472da8b1773bf9f9a02171215-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:e1a57c3d2eededabad8d67d975c7f1a0e56b95751cff193e6af204e6998e4169"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-cb1cd650ce2d918c3906351e721fa882-188cf3279c2b9ebe-01"
                },
                "startTime": "2026-05-07T23:45:03Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://475ecea386e9e23ab0fdf68f0edcf8a351a704e1bc0a47ff0403843d8ccc4801",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:09Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:09Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0529626a9bfa157dd5be5ef2e1d2c94438bec3dd99cd2a08b226e532dfed0571",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:32Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://58881dc91832bc3521468e22666c365e685baa11a99a98a3b867b6de82db332a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:46:15Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fd6ff5e15df520eba01503b92fbe4723e373aae23877608e39eec2209b42e0bc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:46:33Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:46:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://599de528126a8eda557e9d7c6f339df71dbfb9af65e003adc8758bc0154ec249",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:06Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:46:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e42a3eb7be9cc3e66c4ec331783aa03c508c6b2babd9a2471bcc1b860e230f5b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:38Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22@sha256:644ea6ee6f63964ddb0521cd89448bdef04789b907d1f36942f79b77554bbb75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:e1a57c3d2eededabad8d67d975c7f1a0e56b95751cff193e6af204e6998e4169\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "554eb24cc796489c97912e7edff1125b39ecca22"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gh-multi-componfa4e560be39b4c3206280eccf098219a-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/commit_sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-doqzna",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-sjq7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31/records/986c2c02-a9d8-4a75-a08d-4433a9920357",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"2e75539aa24a12a01a652e3d4a7d20b15b538197\",\"eventType\":\"push\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5359416df3724cd31f790fce09404dbe-03f777a5aaad451b-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:44:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928537125",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "2e75539aa24a12a01a652e3d4a7d20b15b538197",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-sjq7v",
                    "tekton.dev/pipelineRunUID": "830038fa-c26b-4b1f-8d7b-e7071a748e31",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min"
                },
                "name": "gh-multi-e624a5e968ed655a0df9ca9849a9f074-prefetch-dependencies",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-sjq7v",
                        "uid": "830038fa-c26b-4b1f-8d7b-e7071a748e31"
                    }
                ],
                "resourceVersion": "91650",
                "uid": "986c2c02-a9d8-4a75-a08d-4433a9920357"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-doqzna"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:45:07Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:45:07Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-e624a5e968ed655a0d9a9f3cc52c6dedc20bafa3907eb59c2d-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5359416df3724cd31f790fce09404dbe-03f777a5aaad451b-01"
                },
                "startTime": "2026-05-07T23:44:17Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b3a86c48c6ce84de222e48dbc1260e727c1973bdb3c26948a9bfdd6c1136e06c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:21Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://68f02acc6edf05f8b46247de9c153ffce1168d5faa5d55df00c723668fdffc22",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:21Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2517f877f2b40f295e4975e24434d64137d9b3c36769c030e6fc41ef00495429",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:06Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://701aaf757cd6f566be1096d45a6992c17ed23ed44c179d3c620a6e07e0f18bc0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:07Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:07Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:6d2fb8ed8f5cd6a3f7703c4e960c662ee59a02584c1710adb11221a2b8347d4f=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:2e75539aa24a12a01a652e3d4a7d20b15b538197.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/commit_sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-vhjudv",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-push-4dhlx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vpgn\n\nRHTAP-Qe-App update gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1/records/5d67710c-99de-49be-90a2-d8b1e448782b",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"c76f390540c1df0efbd12a957f0c384f7a606149\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bfaf542f7e69e5381facc273838160b8-06c461ee6a12489b-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-07T23:44:45Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "74928527675",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "c76f390540c1df0efbd12a957f0c384f7a606149",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-push-4dhlx",
                    "tekton.dev/pipelineRunUID": "75d2a0cc-fd61-4020-9958-3a2c65125ca1",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min"
                },
                "name": "gh-multi-f943dcaa14db8147819580e46c004999-prefetch-dependencies",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-push-4dhlx",
                        "uid": "75d2a0cc-fd61-4020-9958-3a2c65125ca1"
                    }
                ],
                "resourceVersion": "92639",
                "uid": "5d67710c-99de-49be-90a2-d8b1e448782b"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-vhjudv"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:45:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:45:34Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-f943dcaa14db8147813cee746382445ac897985997afebe2aa-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bfaf542f7e69e5381facc273838160b8-06c461ee6a12489b-01"
                },
                "startTime": "2026-05-07T23:44:45Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://64214c0a2bce05a9b599e6fcb66d685355f014b553d86c1265aa049dd7e08938",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:53Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://84ab55e04dadf3fdf35e3bc0961c5516a72f6af614e0f73bb4cf54c34d885d9e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:53Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://68387e719482d90d29b561bfcc47fdd18052ac9fc0db496340aa39f6692f1143",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:34Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2a894da53c9335f58c856919fe8466e91f09ca31a509ec9a2f133e1105251003",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:34Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:34Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:7b3d114e4f8dcd3360a4a5e1d7fc21c2a2d11b2bd1b7ab7f0cbfbeb75a246b78=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:c76f390540c1df0efbd12a957f0c384f7a606149.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt?rev=554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/commit_sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vpgn",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vpgn",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wlqyyr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/build-e2e-uftk/tekton.dev~v1~PipelineRun/gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vpgn\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt/commit/554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-zuzpjt",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b/records/f0c40ca8-a256-4cb0-97c4-34c1d90f6079",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-zuzpjt\",\"commit\":\"554eb24cc796489c97912e7edff1125b39ecca22\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-uftk/results/205bfe99-6331-4308-b533-c79b03e92d2b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-cb1cd650ce2d918c3906351e721fa882-b420317421d9182b-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vpgn"
                },
                "creationTimestamp": "2026-05-07T23:44:12Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-gnbh",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vpgn",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74928535531",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vpgn-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gh-multi-component-child-vpgn",
                    "pipelinesascode.tekton.dev/sha": "554eb24cc796489c97912e7edff1125b39ecca22",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                    "tekton.dev/pipelineRunUID": "205bfe99-6331-4308-b533-c79b03e92d2b",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "41c17c0891dd7d9aa2a32d0de1c18319988186b59e2e52cee985daf9760fcd"
                },
                "name": "gh-multi-fa4e560be39b4c3206280eccf098219a-prefetch-dependencies",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vpgn-on-pull-request-xkbmg",
                        "uid": "205bfe99-6331-4308-b533-c79b03e92d2b"
                    }
                ],
                "resourceVersion": "91341",
                "uid": "f0c40ca8-a256-4cb0-97c4-34c1d90f6079"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vpgn",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-wlqyyr"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:45:03Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:45:03Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-fa4e560be39b4c320663ba014c2e9b17b0d069b1dcf8fb3a04-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-cb1cd650ce2d918c3906351e721fa882-b420317421d9182b-01"
                },
                "startTime": "2026-05-07T23:44:12Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e5859b471274fe687e83d5d2e23bd1038db8f2936c4d6549035dc637bdc9c90b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:17Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3ea27435323738a9120cdcbbab0b865cbeeb64f923a8c9769f7ee5b6eb663df7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:18Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:18Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://17805b6e83db3998417721aee5a9b7dd7bff518fd026e2bb59a748aaff8eeb55",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:02Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:18Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://aff486258992ddfb64c774928523d651d3f864c3284127dd4e3824753e2350b0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:45:02Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:45:02Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn@sha256:a830fb3a19bc310389bf46d550ab610fb733d53d91dd8cac9a676fc6abdb36f6=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-child-vpgn:on-pr-554eb24cc796489c97912e7edff1125b39ecca22.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.redhat.com/nudged-components": "gh-multi-component-child-vpgn",
                    "build.appstudio.redhat.com/nudging-commit": "build-nudge-parent-zuzpjt?rev=c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/nudging-component": "gh-multi-component-parent-vpgn",
                    "build.appstudio.redhat.com/nudging-image": "quay.io/redhat-appstudio-qe/build-e2e-uftk/gh-multi-component-parent-vpgn:c461699bd22ed21feec5ce2f8861b57fb68d7192",
                    "build.appstudio.redhat.com/nudging-pipeline": "gh-multi-component-parent-vpgn-on-push-946q5",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-uftk/results/0cd4f512-cf9a-48c4-85cb-8e802197284c/records/42fde70a-d73f-43a4-be9b-7f11e1b6f76b",
                    "results.tekton.dev/result": "build-e2e-uftk/results/0cd4f512-cf9a-48c4-85cb-8e802197284c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c792fb06499284d1b8d7df7022595839-63fac6b63a396024-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:49:13Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "build.appstudio.redhat.com/type": "nudge",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-pipeline-1778197753-f1f56",
                    "tekton.dev/pipelineRun": "renovate-pipeline-1778197753-f1f56",
                    "tekton.dev/pipelineRunUID": "0cd4f512-cf9a-48c4-85cb-8e802197284c",
                    "tekton.dev/pipelineTask": "renovate"
                },
                "name": "renovate-pipeline-1778197753-f1f56-renovate",
                "namespace": "build-e2e-uftk",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-pipeline-1778197753-f1f56",
                        "uid": "0cd4f512-cf9a-48c4-85cb-8e802197284c"
                    }
                ],
                "resourceVersion": "109037",
                "uid": "42fde70a-d73f-43a4-be9b-7f11e1b6f76b"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vpgn",
                "taskSpec": {
                    "steps": [
                        {
                            "command": [
                                "bash",
                                "-c",
                                "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_9cf1f21a88 RENOVATE_CONFIG_FILE=/configs/gh-multi-component-child-vpgn-f8349.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_uftk_gh_multi_component_parent_vpgn_d8d2ffd321','password':'${TOKEN_3928052562}'}]\" renovate"
                            ],
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                }
                            ],
                            "envFrom": [
                                {
                                    "prefix": "TOKEN_",
                                    "secretRef": {
                                        "name": "renovate-pipeline-1778197753-f1f56"
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31",
                            "name": "renovate",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "seccompProfile": {
                                    "type": "RuntimeDefault"
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/configs",
                                    "name": "renovate-pipeline-1778197753-f1f56"
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "name": "renovate-pipeline-1778197753-f1f56"
                            },
                            "name": "renovate-pipeline-1778197753-f1f56"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "renovate-ca-1778197753-f1f56"
                            },
                            "name": "trusted-ca"
                        }
                    ]
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "completionTime": "2026-05-07T23:51:01Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:51:01Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-pipeline-1778197753-f1f56-renovate\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:29a2f31\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-pipeline-1778197753-f1f56-renovate-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-c792fb06499284d1b8d7df7022595839-63fac6b63a396024-01"
                },
                "startTime": "2026-05-07T23:49:13Z",
                "steps": [
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:51:01Z",
                            "message": "Step renovate terminated as pod renovate-pipeline-1778197753-f1f56-renovate-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:49:13Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "command": [
                                "bash",
                                "-c",
                                "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_9cf1f21a88 RENOVATE_CONFIG_FILE=/configs/gh-multi-component-child-vpgn-f8349.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_uftk_gh_multi_component_parent_vpgn_d8d2ffd321','password':'${TOKEN_3928052562}'}]\" renovate"
                            ],
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                }
                            ],
                            "envFrom": [
                                {
                                    "prefix": "TOKEN_",
                                    "secretRef": {
                                        "name": "renovate-pipeline-1778197753-f1f56"
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31",
                            "name": "renovate",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "seccompProfile": {
                                    "type": "RuntimeDefault"
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/configs",
                                    "name": "renovate-pipeline-1778197753-f1f56"
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "name": "renovate-pipeline-1778197753-f1f56"
                            },
                            "name": "renovate-pipeline-1778197753-f1f56"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "renovate-ca-1778197753-f1f56"
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949/records/9e425e60-289e-4105-85cc-9d3b2ee8523f",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d38f93592b63eaff4645f9092576716-54a5692213fd1e94-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:36:32Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.3",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-szlcrjbsku",
                    "tekton.dev/pipelineRunUID": "6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags"
                },
                "name": "buildah-demo-szlcrjbsku-apply-tags",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-szlcrjbsku",
                        "uid": "6e01e1c8-6c1f-4a95-8829-cdc440096949"
                    }
                ],
                "resourceVersion": "69415",
                "uid": "9e425e60-289e-4105-85cc-9d3b2ee8523f"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:36:39Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:36:39Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-szlcrjbsku-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-8d38f93592b63eaff4645f9092576716-54a5692213fd1e94-01"
                },
                "startTime": "2026-05-07T23:36:33Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d94fee722682deb737042ff12d4aee8df6913d444c452619f47c38e2086504b6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:38Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:36:37Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku",
                                "--digest",
                                "sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-92ec13bc1b",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949/records/7a066823-c652-4b1b-b6ac-0c0c9fde9d9a",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d38f93592b63eaff4645f9092576716-c8958dc60bc83029-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:34:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.9.3",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-szlcrjbsku",
                    "tekton.dev/pipelineRunUID": "6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah"
                },
                "name": "buildah-demo-szlcrjbsku-build-container",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-szlcrjbsku",
                        "uid": "6e01e1c8-6c1f-4a95-8829-cdc440096949"
                    }
                ],
                "resourceVersion": "67709",
                "uid": "7a066823-c652-4b1b-b6ac-0c0c9fde9d9a"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Containerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "be3214825d8af1a44d1406df6233660e8372d26f"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/conforma/golden-container.git"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah:0.9@sha256:62f09c50d552eac57e17638c67e88b0982352a71975858c8ba262bcff293de06"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "source",
                        "persistentVolumeClaim": {
                            "claimName": "app-studio-default-workspace"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:36:01Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:36:01Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-szlcrjbsku-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "62f09c50d552eac57e17638c67e88b0982352a71975858c8ba262bcff293de06"
                        },
                        "entryPoint": "buildah",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images@sha256:0ba56d96e583e95e95ad5be064e600cb4f0e0b95f0593257447a9286d2bd03f8"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d38f93592b63eaff4645f9092576716-c8958dc60bc83029-01"
                },
                "startTime": "2026-05-07T23:34:01Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6b7eaabb3c0e0e31ad5dfed35acb9bfb9b6a3ee2ff8a5a11e4faeb9a7b63de3e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:12Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:34:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4e9bc5bb56de31da0a0aec74d32dc08287b73d3632790fdc474af1b4562e928a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:19Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://310befe66f855c6686697ec921b585417ad1ce56c51d77fb51caaac39e4d15e7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:23Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b5223fc8ac5c7f4624491a4ad7e260e8759a08b28b0c88f0b83bf5f942b59620",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:37Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://27891bb88f1d98b56b1cee998f6f9a66cf37933db2b5c72b91ad4a72d83fec28",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:01Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:0ba56d96e583e95e95ad5be064e600cb4f0e0b95f0593257447a9286d2bd03f8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:37Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "be3214825d8af1a44d1406df6233660e8372d26f"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/conforma/golden-container.git"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Containerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n  \"$source_dir_path\" | \"$source_dir_path/\"*)\n    # path is valid, do nothing\n    ;;\n  *)\n    echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n    echo \"Source path: $source_dir_path\" \u003e\u00262\n    echo \"Resolved path: $context_dir_path\" \u003e\u00262\n    exit 1\n    ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e /etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n    case $1 in\n        --build-args)\n            shift\n            # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n            # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n            # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do build_args+=(\"$1\"); shift; done\n            ;;\n        --env)\n            shift\n            # Collect env entries of the form KEY=value\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do env_vars+=(\"$1\"); shift; done\n            ;;\n        --labels)\n            shift\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do LABELS+=(\"--label\" \"$1\"); shift; done\n            ;;\n        --annotations)\n            shift\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ANNOTATIONS+=(\"--annotation\" \"$1\"); shift; done\n            ;;\n        *)\n            echo \"unexpected argument: $1\" \u003e\u00262\n            exit 2\n            ;;\n    esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e /shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n    jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"\n    then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ] ; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ] ; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/workspace/source/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e /shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/workspace/source/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n      -e 'H;1h;$!d;x' \\\n      -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n      \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null` `\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e \"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key \\\n                  -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z \\\n                  -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"\n    then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e /dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c \"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n    buildah build\n    \"${VOLUME_MOUNTS[@]}\"\n    \"${BUILDAH_ARGS[@]}\"\n    \"${LABELS[@]}\"\n    \"${ANNOTATIONS[@]}\"\n    --tls-verify=\"$TLSVERIFY\" --no-cache\n    --ulimit nofile=4096:4096\n    --http-proxy=false\n    -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e /shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "buildah-demo-szlcrjbsku-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"\nthen\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/workspace/source/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"\nthen\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c \"/workspace/source\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/workspace/source/image-digest\"\n} \u003e \"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"\nthen\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n  [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n  [rekorInternalUrl]=REKOR_URL\n  [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n  [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n  [rekorInternalUrl]=rekorExternalUrl\n  [fulcioInternalUrl]=fulcioExternalUrl\n  [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e /shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n  then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e /tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"\n  then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\n  cyclonedx)\n    syft_sbom_type=cyclonedx-json@1.5 ;;\n  spdx)\n    syft_sbom_type=spdx-json@2.3 ;;\n  *)\n    echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n    exit 1\n    ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/workspace/source/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/workspace/source/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/workspace/source/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/source/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n    --additional-base-images)\n      shift\n      while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ADDITIONAL_BASE_IMAGES+=(\"$1\"); shift; done\n      ;;\n    *)\n      echo \"unexpected argument: $1\" \u003e\u00262\n      exit 2\n      ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/workspace/source/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/workspace/source/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/workspace/source/sbom-source.json\")\nfi\n\nif [ -f \"/workspace/source/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/workspace/source/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n  then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"\n  then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace containing the source code to build.",
                            "name": "source"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949/records/abe23707-fa27-46c7-bdbb-50bb8d5d1959",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d38f93592b63eaff4645f9092576716-d3d742d5bccf15a5-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:36:02Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.3",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-szlcrjbsku",
                    "tekton.dev/pipelineRunUID": "6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index"
                },
                "name": "buildah-demo-szlcrjbsku-build-image-index",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-szlcrjbsku",
                        "uid": "6e01e1c8-6c1f-4a95-8829-cdc440096949"
                    }
                ],
                "resourceVersion": "69288",
                "uid": "abe23707-fa27-46c7-bdbb-50bb8d5d1959"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:36:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:36:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-szlcrjbsku-build-image-index-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d38f93592b63eaff4645f9092576716-d3d742d5bccf15a5-01"
                },
                "startTime": "2026-05-07T23:36:02Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://96cd98f3d64c6419140b8a1bb24247963b263cdd2fceaff20ef84ef572716b23",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:28Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:36:26Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7b253a4be14c3162979b67f3c600eb86a1476180721fd6b91a82513d17d45909",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:28Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:36:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3c53df2a76d89c0ba4a5da936f1299c2f9433e1ce4088da56e6a2c4d65695b2b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:30Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:36:28Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"buildah-demo-szlcrjbsku-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-92ec13bc1b",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949/records/5f949217-bece-4b43-95f8-e43bf97a669f",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d38f93592b63eaff4645f9092576716-4835be2450b9b637-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:33:26Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-szlcrjbsku",
                    "tekton.dev/pipelineRunUID": "6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone"
                },
                "name": "buildah-demo-szlcrjbsku-clone-repository",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-szlcrjbsku",
                        "uid": "6e01e1c8-6c1f-4a95-8829-cdc440096949"
                    }
                ],
                "resourceVersion": "59641",
                "uid": "5f949217-bece-4b43-95f8-e43bf97a669f"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/conforma/golden-container.git"
                    },
                    {
                        "name": "revision",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone:0.1@sha256:7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "output",
                        "persistentVolumeClaim": {
                            "claimName": "app-studio-default-workspace"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:33:45Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:33:45Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-szlcrjbsku-clone-repository-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21"
                        },
                        "entryPoint": "git-clone",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "be3214825d8af1a44d1406df6233660e8372d26f"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/conforma/golden-container.git"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "be3214825d8af1a44d1406df6233660e8372d26f"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1775533888"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "be32148"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/conforma/golden-container.git"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d38f93592b63eaff4645f9092576716-4835be2450b9b637-01"
                },
                "startTime": "2026-05-07T23:33:26Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7e8b7e17708f9205327108b8be5aa4d61b0dd5feb4ecc216132400a4366687ff",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:33:43Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"be3214825d8af1a44d1406df6233660e8372d26f\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1},{\"key\":\"commit\",\"value\":\"be3214825d8af1a44d1406df6233660e8372d26f\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1775533888\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"be32148\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:33:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e13bf771dbc051234e54a53776eed5853bb0f7c4c47c8bb5c24ec222c5cc9234",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:33:44Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"be3214825d8af1a44d1406df6233660e8372d26f\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1},{\"key\":\"commit\",\"value\":\"be3214825d8af1a44d1406df6233660e8372d26f\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1775533888\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"be32148\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:33:44Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone Task will clone a repo from the provided url into the output Workspace. By default the repo will be cloned into the root of your Workspace.",
                    "params": [
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "source",
                            "description": "Subdirectory inside the `output` Workspace to clone the repo into.",
                            "name": "subdirectory",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Clean out the contents of the destination directory if it already exists before cloning.",
                            "name": "deleteExisting",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Deprecated. Has no effect. Will be removed in the future.",
                            "name": "gitInitImage",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/conforma/golden-container.git"
                                },
                                {
                                    "name": "PARAM_REVISION"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBDIRECTORY",
                                    "value": "source"
                                },
                                {
                                    "name": "PARAM_DELETE_EXISTING",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_GIT_INIT_IMAGE"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_OUTPUT_PATH",
                                    "value": "/workspace/output"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ] ; then\n  set -x\nfi\n\nif [ -n \"${PARAM_GIT_INIT_IMAGE}\" ]; then\n  echo \"WARNING: provided deprecated gitInitImage parameter has no effect.\"\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e \"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e \"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\n\ncleandir() {\n  # Delete any existing contents of the repo directory if it exists.\n  #\n  # We don't just \"rm -rf ${CHECKOUT_DIR}\" because ${CHECKOUT_DIR} might be \"/\"\n  # or the root of a mounted volume.\n  if [ -d \"${CHECKOUT_DIR}\" ] ; then\n    # Delete non-hidden files and directories\n    rm -rf \"${CHECKOUT_DIR:?}\"/*\n    # Delete files and directories starting with . but excluding ..\n    rm -rf \"${CHECKOUT_DIR}\"/.[!.]*\n    # Delete files and directories starting with .. plus any other character\n    rm -rf \"${CHECKOUT_DIR}\"/..?*\n  fi\n}\n\nif [ \"${PARAM_DELETE_EXISTING}\" = \"true\" ] ; then\n  cleandir\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\nif ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n  echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n  echo \"--- Git Status ---\"\n  git status\n  echo \"------------------\"\n  exit 1\nfi\n\n# Check if there are changes staged for commit\nif git diff --staged --quiet; then\n  echo \"No diff was found, skipping merge...\" \u003e\u00262\nelse\n  echo \"Merge successful (no conflicts found), committing...\"\nif ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n  echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n  exit 1\nfi\n  MERGED_SHA=$(git rev-parse HEAD)\n  echo \"New HEAD after merge: ${MERGED_SHA}\"\n  echo \"${MERGED_SHA}\" \u003e \"/tekton/results/merged_sha\"\nfi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e \"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e \"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ] ; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBDIRECTORY",
                                    "value": "source"
                                },
                                {
                                    "name": "WORKSPACE_OUTPUT_PATH",
                                    "value": "/workspace/output"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink\n  do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ] ; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ] ; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The git repo will be cloned onto the volume backing this Workspace.",
                            "name": "output"
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        },
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949/records/e7a18540-2cad-4262-b849-c9318a728ade",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d38f93592b63eaff4645f9092576716-fe2a64f7f1121304-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:33:12Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.4.2",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-szlcrjbsku",
                    "tekton.dev/pipelineRunUID": "6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init"
                },
                "name": "buildah-demo-szlcrjbsku-init",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-szlcrjbsku",
                        "uid": "6e01e1c8-6c1f-4a95-8829-cdc440096949"
                    }
                ],
                "resourceVersion": "58943",
                "uid": "e7a18540-2cad-4262-b849-c9318a728ade"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:33:25Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:33:25Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-szlcrjbsku-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d38f93592b63eaff4645f9092576716-fe2a64f7f1121304-01"
                },
                "startTime": "2026-05-07T23:33:12Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ec9d182630ecbac2b5e965b023d51c690569817fe0149139db6c7da4ae544713",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:33:25Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:33:25Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-92ec13bc1b",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949/records/f81ae378-db04-4913-95c0-45a5c2f3521e",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d38f93592b63eaff4645f9092576716-e9a560d94a5863c5-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:33:45Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.3.2",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-szlcrjbsku",
                    "tekton.dev/pipelineRunUID": "6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies"
                },
                "name": "buildah-demo-szlcrjbsku-prefetch-dependencies",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-szlcrjbsku",
                        "uid": "6e01e1c8-6c1f-4a95-8829-cdc440096949"
                    }
                ],
                "resourceVersion": "60384",
                "uid": "f81ae378-db04-4913-95c0-45a5c2f3521e"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies:0.3@sha256:214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "source",
                        "persistentVolumeClaim": {
                            "claimName": "app-studio-default-workspace"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:34:01Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:34:01Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-szlcrjbsku-prefetch-dependencies-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f"
                        },
                        "entryPoint": "prefetch-dependencies",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies"
                    }
                },
                "spanContext": {
                    "traceparent": "00-8d38f93592b63eaff4645f9092576716-e9a560d94a5863c5-01"
                },
                "startTime": "2026-05-07T23:33:45Z",
                "steps": [
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9778f3e616eb0e228e3a724e2d3fd332b411d8688e885c3bd0b84d47de756709",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:34:00Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:33:57Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/workspace/source/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/workspace/source/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/workspace/source/cachi2/cachi2.env /workspace/source/cachi2/prefetch.env /workspace/source/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e /mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace with the source code, prefetch artifacts will be stored on the workspace as well",
                            "name": "source"
                        },
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-92ec13bc1b",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949/records/e29888c2-9458-45d3-8e6d-bd774c8b1715",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d38f93592b63eaff4645f9092576716-ada70f554cd9f5cd-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:36:32Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.3.1",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-szlcrjbsku",
                    "tekton.dev/pipelineRunUID": "6e01e1c8-6c1f-4a95-8829-cdc440096949",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile"
                },
                "name": "buildah-demo-szlcrjbsku-push-dockerfile",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-szlcrjbsku",
                        "uid": "6e01e1c8-6c1f-4a95-8829-cdc440096949"
                    }
                ],
                "resourceVersion": "71677",
                "uid": "e29888c2-9458-45d3-8e6d-bd774c8b1715"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Containerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile:0.3@sha256:359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "app-studio-default-workspace"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:37:27Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:37:27Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-szlcrjbsku-push-dockerfile-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7"
                        },
                        "entryPoint": "push-dockerfile",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images@sha256:771294a24a387f16bfc64993c4ef2f45e60157232ef30a056954da4ee03c19d2"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d38f93592b63eaff4645f9092576716-ada70f554cd9f5cd-01"
                },
                "startTime": "2026-05-07T23:36:33Z",
                "steps": [
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1088d854624f51f97aef29d47ac388749991772b974c031be3a2f4ca4f87546b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:37:26Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:771294a24a387f16bfc64993c4ef2f45e60157232ef30a056954da4ee03c19d2\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:37:25Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        },
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                ".",
                                "--containerfile",
                                "Containerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku",
                                "--image-digest",
                                "sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/workspace/workspace"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace containing the source code from where the Dockerfile is discovered.",
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/ed794b44-6e3c-4ad2-a3eb-76af81936fd6/records/75f6dc3d-6faa-409a-ac02-5aa608bd0f1c",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/ed794b44-6e3c-4ad2-a3eb-76af81936fd6",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bfdb2f6fa05db02d16963cf69f837fd1-dd42633ed50c0f62-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:42:00Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-2p9l4",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-2p9l4",
                    "tekton.dev/pipelineRunUID": "ed794b44-6e3c-4ad2-a3eb-76af81936fd6",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-2p9l4-verify-enterprise-contract",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-2p9l4",
                        "uid": "ed794b44-6e3c-4ad2-a3eb-76af81936fd6"
                    }
                ],
                "resourceVersion": "80513",
                "uid": "75f6dc3d-6faa-409a-ac02-5aa608bd0f1c"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-dwdj/dummy-public-key-abwtgjkcmc"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:42:11Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:42:11Z",
                        "message": "\"step-assert\" exited with code 1: Error",
                        "reason": "Failed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-450bbe37649aeb4558a505c55ba8e3be-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197330\",\"namespace\":\"\",\"successes\":0,\"failures\":2,\"warnings\":0,\"result\":\"FAILURE\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bfdb2f6fa05db02d16963cf69f837fd1-dd42633ed50c0f62-01"
                },
                "startTime": "2026-05-07T23:42:00Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://758b95900a35c7cf96ee711e3c257af966fe9edf58a623990c307140cbb8d4d6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:06Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:06Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9b82a9fbf546648cd4b8ed273c970a60190bccb483c4c01f555bcba1fed4cea0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:06Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://05ff85fab7deae20bc953cb042d53b967b323b8da97652547603e01604f880d0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:10Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197330\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://037aa8138c8a8d83b7baa3ee5e09bb2c4f178cf42d01734a8b4e5cb1bfaa210f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197330\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://febb5c81abff104c0a2d4d0d55e3f74296a968fc5b3597706ce690d87f92acd5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197330\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3b7803cc33784db1d627959bd72437937ff209320dca3ed34f7c3f51a5bd1f23",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197330\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f95d711116a912eef9e0160c52efc0c2dcb23c7a13ee360f2c0b24b275bab10f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197330\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f3b0b1d45b8af292d046ad023f175d5586d2f6c5d2f0121a83283ed840995b7d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197330\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:42:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0db7129be146a08ad1560c7637a65a2ffe2c4398b0d377a9ab17c6ebbfc13ea4",
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197330\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Error",
                            "startedAt": "2026-05-07T23:42:11Z"
                        },
                        "terminationReason": "Error"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-dwdj/dummy-public-key-abwtgjkcmc"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/9233e243-add1-4ce6-a5b2-9a78c47d5bc0/records/154357b1-b17f-451a-b9fa-38aabc368932",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/9233e243-add1-4ce6-a5b2-9a78c47d5bc0",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-0b7c35e8917612d9d453609813979ab8-0dec6bb2d75805eb-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:44:22Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-bdqb4",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-bdqb4",
                    "tekton.dev/pipelineRunUID": "9233e243-add1-4ce6-a5b2-9a78c47d5bc0",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-bdqb4-verify-enterprise-contract",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-bdqb4",
                        "uid": "9233e243-add1-4ce6-a5b2-9a78c47d5bc0"
                    }
                ],
                "resourceVersion": "89215",
                "uid": "154357b1-b17f-451a-b9fa-38aabc368932"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/enterprise-contract-tests:e2e-test-unpinned-task-bundle\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-dwdj/unpinned-task-bundle-public-keyigxyalhopc"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:44:36Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:44:36Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-23b753c10f66ef007786f7de7ff43a14-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197475\",\"namespace\":\"\",\"successes\":3,\"failures\":0,\"warnings\":16,\"result\":\"WARNING\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-0b7c35e8917612d9d453609813979ab8-0dec6bb2d75805eb-01"
                },
                "startTime": "2026-05-07T23:44:22Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9d1c8873818c445493b99e04d9bbf88708029365c73b49e141d8aa71bca3be0f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:27Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:27Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ba01581c8363e986aceb3b5278942aadb3c642727be05e232d8716b837b9ac13",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:27Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:27Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://679ab7e670ac238e22163e4ca6b86ec8038f72bb4f44aba6bf74f9897a55575f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:35Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197475\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://70c27cf6bfe6045d0a0a326b716ef5612dbdcbca4a08aa90621b8a86bb3268b1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197475\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cbf1a963fafbb147f9aa0424ba5be57872e679a24ba9de99233ddd82096b3125",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197475\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c040f1db87acf637040eedd1f5977bd4030b6d10f2fa7b54d1ae800fb07d260c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197475\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0a08f74f14eded23a62e04bcea90659a7fc66abcba83cfe4ab6d4561542d930f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197475\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d0ae534c8a1632b74d75f39c6b274b276e1f8b5fe18b4dd33fdea5b91b775c0c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197475\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://60b9642d4f6e992e5dc77ebec5d631fe8081e77da4629b12e1e3dc325b9ff507",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197475\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:36Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/enterprise-contract-tests:e2e-test-unpinned-task-bundle\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-dwdj/unpinned-task-bundle-public-keyigxyalhopc"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/1af45b93-53ac-4873-80a3-0422252264d5/records/b1a7528b-9b0d-4883-aaaf-6e60c511b531",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/1af45b93-53ac-4873-80a3-0422252264d5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7e7f6da5af5994b54a6de53014d9114e-5d05b7670a63f99a-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:41:45Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-bzk6q",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-bzk6q",
                    "tekton.dev/pipelineRunUID": "1af45b93-53ac-4873-80a3-0422252264d5",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-bzk6q-verify-enterprise-contract",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-bzk6q",
                        "uid": "1af45b93-53ac-4873-80a3-0422252264d5"
                    }
                ],
                "resourceVersion": "80000",
                "uid": "b1a7528b-9b0d-4883-aaaf-6e60c511b531"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-dwdj/cosign-public-key"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:41:59Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:41:59Z",
                        "message": "\"step-assert\" exited with code 1: Error",
                        "reason": "Failed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-c706840c8dc1835905153920ad986927-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197318\",\"namespace\":\"\",\"successes\":5,\"failures\":1,\"warnings\":0,\"result\":\"FAILURE\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7e7f6da5af5994b54a6de53014d9114e-5d05b7670a63f99a-01"
                },
                "startTime": "2026-05-07T23:41:45Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c3818ba94e24a66975735cc750fb8301d19aaab62a57837551d22966fbada3dc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:52Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:52Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4b2af2d3ecaed11b77002f38ac5fb20ba3fb3401e94c7e175b68365d8314651e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:52Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ae4285d0c255639810a82204d51116038a62c09a430b43168451642e0a924d99",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:58Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197318\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c5f7697b37006b4521b3ed280b6f02002cdd79c3d490059df9d286e71139c7e6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197318\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5bae441400a7dda77651736da055cb68926489ae354eb6b5eefb687f92c27889",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197318\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7286646a15516618430223f329d9c4aa72a96703aa78c65389d8dea700196d74",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197318\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8d442def3b89164cb30197812c573ca9c6818c6c04e2d9f4ad5af1e900dc60c8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197318\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://30effb5bd412e624f53432339ae52ebccfd23de82bc0354b0edd8001ea4c7792",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197318\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://79467e09bb901bb0c30a2620c745a31f7de55581cf10d401c87166965feca61d",
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:41:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197318\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Error",
                            "startedAt": "2026-05-07T23:41:59Z"
                        },
                        "terminationReason": "Error"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-dwdj/cosign-public-key"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/c16686a3-f300-4a27-8238-dca574bdd1f6/records/a4279302-a90d-4527-a9a2-64f9d439fecb",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/c16686a3-f300-4a27-8238-dca574bdd1f6",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-e9ae698315cb2a774bdb39a1a8285645-31da2eaf037a47ca-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:41:31Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-hv66f",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-hv66f",
                    "tekton.dev/pipelineRunUID": "c16686a3-f300-4a27-8238-dca574bdd1f6",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-hv66f-verify-enterprise-contract",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-hv66f",
                        "uid": "c16686a3-f300-4a27-8238-dca574bdd1f6"
                    }
                ],
                "resourceVersion": "79583",
                "uid": "a4279302-a90d-4527-a9a2-64f9d439fecb"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-dwdj/cosign-public-key"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "false"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:41:44Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:41:44Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-d0bb8712c40b9a204a7692b38cf99cee-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197302\",\"namespace\":\"\",\"successes\":5,\"failures\":1,\"warnings\":0,\"result\":\"FAILURE\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-e9ae698315cb2a774bdb39a1a8285645-31da2eaf037a47ca-01"
                },
                "startTime": "2026-05-07T23:41:31Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1958dabd719d4247941b867f255999ee7349d83e33dc292412ff8b231da559bb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:37Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:37Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://df167f179c27de146f3f11e1173c56b6cd70b26f9b1b2839f070c5b6afc0aaf0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:37Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f48e4c092e91e035d51f023c53c6caf3b021456a9343fcf6d47a0f65409f24a1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:42Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197302\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1442ee939aac38e3de08b7a14dbc5501b9be7b4805eb035d41e789ad209c76b5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:43Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197302\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bc45569b40aa79582c1405f08f74ead4dcd99c713d4b9cbd32b393cd3d1b74fd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:43Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197302\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c32d01e23601843ca643188d7fe9e507ca5e80374ae833308defdf9a472e36d6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:43Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197302\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e9245fa7ace63a4038673fb50fbc77d2a19e75427da8d4794a5c592c966537e4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:43Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197302\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c1772820b313d73ea2dc4c99e58baee0de2ed582045ed3f9b928eb866aafed1a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:43Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197302\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7a44bb21a77b9e6aab60cce5bea4277168b40167283da2d1e67f88691037e6dd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:44Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197302\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:44Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-dwdj/cosign-public-key"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "false",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/c264c77c-f36b-4c2c-bbc7-4f7d8633e7d8/records/7123d9d4-f187-4985-945b-9fda62ff953b",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/c264c77c-f36b-4c2c-bbc7-4f7d8633e7d8",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5b401db4fb71b53b6f8d6029f26474c2-e410c22777e97831-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:44:07Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-jblvh",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-jblvh",
                    "tekton.dev/pipelineRunUID": "c264c77c-f36b-4c2c-bbc7-4f7d8633e7d8",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-jblvh-verify-enterprise-contract",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-jblvh",
                        "uid": "c264c77c-f36b-4c2c-bbc7-4f7d8633e7d8"
                    }
                ],
                "resourceVersion": "88503",
                "uid": "7123d9d4-f187-4985-945b-9fda62ff953b"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-dwdj/golden-image-public-keyocfgvrfcxd"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:44:20Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:44:20Z",
                        "message": "\"step-assert\" exited with code 1: Error",
                        "reason": "Failed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-4b55b122b3bd354c181dfaef4594780d-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197459\",\"namespace\":\"\",\"successes\":3,\"failures\":11,\"warnings\":0,\"result\":\"FAILURE\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5b401db4fb71b53b6f8d6029f26474c2-e410c22777e97831-01"
                },
                "startTime": "2026-05-07T23:44:07Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c352f147db1929da933bce6b489ffdddb0e8bb1cf8d6f9d2a1cb38de82a5c1ad",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:12Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:12Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f0f57568d0bac76a55dbc228378c598bb50ce12355a264a7925aa71788a511cf",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:12Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6134c9ce79e107eef43eeea99065c88f83852361e3b04f2659c0c18617e53b40",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:19Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197459\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e198a9fce71d6add9c5873d394862453797dc1177ea8a3e56882a08b6cf5049c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:19Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197459\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:19Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c9ffba4e5b5ddb812dec0adde6200a14074d1f2922d86ba00460722b06bce794",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:20Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197459\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c8b7b58c3bfd870c4a03c517e41becc1790b2a98dfaceb6c761d7434c7932f76",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:20Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197459\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://295ad1a5491733f8f27ac09a8464078f78a928fd58f7b758d4b30d0aa81f5293",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:20Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197459\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c02ae973a7e23f79b4165ecd80525e8ea18d75cffb3dd06701b194299d1dcff3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:20Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197459\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f2779a0169487b16cc8b9badde8078d59e87335d59670c226dd67448b9319af2",
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:44:20Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197459\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Error",
                            "startedAt": "2026-05-07T23:44:20Z"
                        },
                        "terminationReason": "Error"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-dwdj/golden-image-public-keyocfgvrfcxd"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/288bca3d-a23e-4255-9a10-e5ec9c5da1af/records/d5ef0997-ed62-49b3-ba72-de57285cc7b4",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/288bca3d-a23e-4255-9a10-e5ec9c5da1af",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4bdc8dfc40f282709fbf6fbfcb3e5030-2dd68efe16df1d8e-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:43:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-mk4kb",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-mk4kb",
                    "tekton.dev/pipelineRunUID": "288bca3d-a23e-4255-9a10-e5ec9c5da1af",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-mk4kb-verify-enterprise-contract",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-mk4kb",
                        "uid": "288bca3d-a23e-4255-9a10-e5ec9c5da1af"
                    }
                ],
                "resourceVersion": "87745",
                "uid": "d5ef0997-ed62-49b3-ba72-de57285cc7b4"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-dwdj/golden-image-public-keywghznfsmdp"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:44:05Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:44:05Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-b321ad202a97d5fa84c1f0f68907e9e6-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197444\",\"namespace\":\"\",\"successes\":393,\"failures\":0,\"warnings\":48,\"result\":\"WARNING\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4bdc8dfc40f282709fbf6fbfcb3e5030-2dd68efe16df1d8e-01"
                },
                "startTime": "2026-05-07T23:43:36Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d548f6412a72e68b71215513ac9a32bc8ee633bae294328618297a92061755f8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:42Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:42Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://481eeb26335c922e7910b518e6b4bc6f6aea1507aa136e87cb4d433897f4d0a0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:42Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://739199a80b5774c01c166cc216925ad4cbecab550c01c41aab6b20fdfe9f0c6e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:04Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197444\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":48,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ea265b7d5e49405f75b7fb5c89e4404e242222b0d1dd698e2da5bc6a8971c09c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:04Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197444\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":48,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8e84dc72c8994f6edab110a62dece4018f157059a85192e14cda920d51484295",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:04Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197444\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":48,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1b455e41556d2c9af15afa9af53e5659a284a0754ae71a1c0db6ec55d58418f8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:04Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197444\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":48,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://db3a897b170d85fc13354f7de1c3d96ff068f7f7c031175848b918b5ea7d38ef",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:04Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197444\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":48,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8434f262336dace924355e6ec3dd9843d6ca4911fa7e9abb1e21026ccb7ef752",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:05Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197444\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":48,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:05Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0a14c224dd0aad2e7fd0224c2a9d27cafa70a171e1ec902e8219138de23473ec",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:44:05Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197444\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":48,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:44:05Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-dwdj/golden-image-public-keywghznfsmdp"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/9ee572e1-9f7d-4ade-9277-fd235ce3f03c/records/1114db8f-51b3-425c-a9e2-c215e3842da1",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/9ee572e1-9f7d-4ade-9277-fd235ce3f03c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4b09861852bc7dd740159864eda4e40c-0001231f9f90efcd-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:42:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-ngtdz",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-ngtdz",
                    "tekton.dev/pipelineRunUID": "9ee572e1-9f7d-4ade-9277-fd235ce3f03c",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-ngtdz-verify-enterprise-contract",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-ngtdz",
                        "uid": "9ee572e1-9f7d-4ade-9277-fd235ce3f03c"
                    }
                ],
                "resourceVersion": "84953",
                "uid": "1114db8f-51b3-425c-a9e2-c215e3842da1"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-dwdj/cosign-public-key"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:43:16Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:43:16Z",
                        "message": "\"step-assert\" exited with code 1: Error",
                        "reason": "Failed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-95075d325a0cc8cdc5998ed2885609ad-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197394\",\"namespace\":\"\",\"successes\":0,\"failures\":6,\"warnings\":0,\"result\":\"FAILURE\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4b09861852bc7dd740159864eda4e40c-0001231f9f90efcd-01"
                },
                "startTime": "2026-05-07T23:42:16Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4591b7a51efde7bc85fb298e88c1c929addbb3ad53d3ec9e88cc74e7a55b2710",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:08Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:08Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6e27f2a0d2bc2dd200736f23cf91cfcd45997b2701cf00eeefd4988e574fb364",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:08Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:08Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://58d7d409364d6a7feeb8364b31baa30f384a11f48d5d890b142629efa52318a6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:14Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197394\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:08Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://65702ba1063799077d61c136c0fb4a77918e963de7b90db1ba1fef96aae3a86a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:15Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197394\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4b1cef4c27f607a81f08dd955a9111f047b670d9344fcf7307a199a0cda442f1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:15Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197394\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b83602b43a7f0448958551fa7af535c527d648edccdcdf0f12b721a706ef7271",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:15Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197394\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://28a79e128a82225c43ebb619e0baf543f45304f749b5ee0f96e14e809c303715",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:15Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197394\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bff2450e5d65347afc79bc71aaa37b8706666002543c9ab06ab3e2143dce8bd7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:15Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197394\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://75ede25f8f25e6271eddbf14efa4302d7df7bd59dffc2ba2d619a8176f59240c",
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:43:15Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197394\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Error",
                            "startedAt": "2026-05-07T23:43:15Z"
                        },
                        "terminationReason": "Error"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-dwdj/cosign-public-key"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/ac2b64f4-4858-4fa6-bf13-54d6a235fe89/records/0779d150-0ee8-4aa5-84f3-57e2446bb7d0",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/ac2b64f4-4858-4fa6-bf13-54d6a235fe89",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d96d8616c836fec6a04b63509de96bb-99f545572815d0da-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:37:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-p5q57",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-p5q57",
                    "tekton.dev/pipelineRunUID": "ac2b64f4-4858-4fa6-bf13-54d6a235fe89",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-p5q57-verify-enterprise-contract",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-p5q57",
                        "uid": "ac2b64f4-4858-4fa6-bf13-54d6a235fe89"
                    }
                ],
                "resourceVersion": "79275",
                "uid": "0779d150-0ee8-4aa5-84f3-57e2446bb7d0"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-dwdj/cosign-public-key"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:41:30Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:41:30Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-80ee9d92b2adf38da71945bef042b411-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197287\",\"namespace\":\"\",\"successes\":5,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d96d8616c836fec6a04b63509de96bb-99f545572815d0da-01"
                },
                "startTime": "2026-05-07T23:37:31Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://652b55022563b85e5e606400e188411ebb67541c2b4647af1c5e22ff8c3d4437",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:20Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:20Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cfe36e2d2c70d98047f08e62901f000630b2bcc4e599547d16d26ad6ad366e82",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:21Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://62ced0d3bf2324a00cef098dd7afe78724ce2f38946fa9ba7d49283dae5090b0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:27Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197287\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a13a8e36f6cf356b6419ad42d6a91a95ac8bdd70aa81a0243f331fef0af9648e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:28Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197287\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f527360e195c865ade0ecbaea54a9341dde81019497748e8d86f5e0fd1fa666d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:28Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197287\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://174dd68911950af0a36e927f8b06e8514bd6d593411d65b23e42ab953ad87ead",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:29Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197287\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fe23b680a67dbdf9e35819e126a7f1c94eb7014583531f61f71127f932419ecc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:29Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197287\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fdfa557c8ea7ce8b441b1be00724f2ac5400489832fb5cd07c6c467bc5b95533",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:29Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197287\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://63b20ab5b249ecad9e5536fbf0499ede6c9cb6559e29ec38f58044dc09a3de18",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:41:30Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197287\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:30Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-szlcrjbsku@sha256:561fb19e06477a649c8aa37261f91c412985ccf5f5b8d36cf4f8e2f10d14e145\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-dwdj/cosign-public-key"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-dwdj/results/1c985ced-d92e-4dc1-9690-7f72ad891eb1/records/b5d00a17-c8ca-4716-ab14-1c5c54b93dc2",
                    "results.tekton.dev/result": "chains-e2e-dwdj/results/1c985ced-d92e-4dc1-9690-7f72ad891eb1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b6b615cb0b833db763de4d3a1b46b05b-a81588ef8f8a6342-01\"}"
                },
                "creationTimestamp": "2026-05-07T23:43:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-t9h82",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-t9h82",
                    "tekton.dev/pipelineRunUID": "1c985ced-d92e-4dc1-9690-7f72ad891eb1",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-t9h82-verify-enterprise-contract",
                "namespace": "chains-e2e-dwdj",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-t9h82",
                        "uid": "1c985ced-d92e-4dc1-9690-7f72ad891eb1"
                    }
                ],
                "resourceVersion": "85876",
                "uid": "b5d00a17-c8ca-4716-ab14-1c5c54b93dc2"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}},{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-dwdj/golden-image-public-keyxuudhxcggb"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:43:35Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:43:35Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-117fb408230dad3d60bdee6c9cb38114-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197413\",\"namespace\":\"\",\"successes\":84,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-b6b615cb0b833db763de4d3a1b46b05b-a81588ef8f8a6342-01"
                },
                "startTime": "2026-05-07T23:43:17Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1fb5aec9ebaf077bff345782409ca07bef249356cd1a24dda683feb733a87a09",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:23Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:23Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a9a2721624b69c5d4e3ffc5a3a65e5f6e211689c6a7809a91d978d95fd212d32",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:23Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://222753e1ea8c262ad704fe8e3c584b57243e08e929aeeac045f00a3fb8cdbb5a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:33Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197413\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://424ea80e486c29c9b9b2746f1d5f39136e17fbc5532e846659a6c74527d4fd13",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:34Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197413\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3dbd7e866c8f95f0673e266bb66a9007920b495d7ad00b80545bc7a7a702de5a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:34Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197413\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4f48fa5916cb9123600418132c499b34157b6b85881929897557bae4c38483f8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:34Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197413\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://160bc3bb79d2c4f36d1ba9cfe83cdb6ad130e66737c293352cacc9913020f6a4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:34Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197413\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ce0cd137e8e6f5595d62d0cc988d773dd8400599c67309ce9019a2685d3c8933",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:34Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197413\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://03d6e89204a6bd7d63764cc7c900b964858760496c86ea2cc22c5f81dec4a7bd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:43:34Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197413\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:43:34Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}},{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-dwdj/golden-image-public-keyxuudhxcggb"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/b9e4b92e-2edb-4ed1-a6bd-44eb117387af",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-43f3b56f846a3458-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:54Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mat1bf2570b98f8938014a23eb659225587-deprecated-base-image-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "162739",
                "uid": "b9e4b92e-2edb-4ed1-a6bd-44eb117387af"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:07Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:07Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mat1bf2570b98f8938014a23eb6e5ce372004d244694c8acded5559babe-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\", \"digests\": [\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-08T00:17:06+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":2}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-43f3b56f846a3458-01"
                },
                "startTime": "2026-05-08T00:16:54Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://784712b8531c0bbf6abd09b384745cbe0582c88c5b85f6701625979207888192",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:06Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\\\", \\\"digests\\\": [\\\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:06+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":2}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:00Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/0c506a7e-6a73-4e9a-a381-a947a493b76c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-be8991b4f8d22ec7-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:44Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mat50b0f9eda4c034ab3db1f2c49bd0e919-deprecated-base-image-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "161989",
                "uid": "0c506a7e-6a73-4e9a-a381-a947a493b76c"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:57Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:57Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mat50b0f9eda4c034ab3db1f2c4b9437eff6dbddf5d6bc4968e03736faa-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\", \"digests\": [\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-08T00:16:56+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":2}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-be8991b4f8d22ec7-01"
                },
                "startTime": "2026-05-08T00:16:44Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3622a8b83087e91a928a854f16ccb5e55648d78b1647baeef4c5b518d59c6fd3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:56Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\\\", \\\"digests\\\": [\\\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:56+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":2}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:48Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/4d304c98-57a9-4b78-8462-c88973b8f565",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-c02b70ab07ef0540-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "matb1bc0e9f2433df63f04db074b70df8ff-deprecated-base-image-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "163810",
                "uid": "4d304c98-57a9-4b78-8462-c88973b8f565"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:34Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "matb1bc0e9f2433df63f04db0748b9065f1b0998e9a7adf4634dfe6f107-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\", \"digests\": [\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-08T00:17:34+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":2}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-c02b70ab07ef0540-01"
                },
                "startTime": "2026-05-08T00:17:17Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9b30c1fdb1cddf481d1434f48ad53a9bb4ed2568373069aae326fe2c7fa97c27",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:34Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\\\", \\\"digests\\\": [\\\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:34+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":2}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:21Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/71c37672-d2b9-40bf-974a-bf37d7819e8a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-aebb9954d2746509-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:15:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-1bf2570b98f8938014a23eb659225587-prefetch-dependencies",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "158102",
                "uid": "71c37672-d2b9-40bf-974a-bf37d7819e8a"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-zqgkzb"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:15:37Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:15:37Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-1bf2570b98f8938014a233fe585cbccbc3c4c94016c71e4bdf-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-aebb9954d2746509-01"
                },
                "startTime": "2026-05-08T00:15:26Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f5be8ec4ea6a584899def9f0d6b101549673d79f4bb086af981b293bfc533173",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:32Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://72f4477e9d85739831fa3cdf7c075b15a2a7c3397bd13d0e385eb0e71cb0ca56",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:32Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://92f65bac2d225b30af820097aba59d6a0b2763e75a376d58499d5c2b80fd2bfd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:35Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://65eaab0b346f2a86f35652f4db3d5dd6737f3430ba8f3a7923040beb028823cc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:36Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:36Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/8a86d8ef-88c7-4103-a36a-96624abf4fc6",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-5e6931838b29b8c5-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-reque6ec5f17456c57c58fcf3da02c0630b9a",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "163777",
                "uid": "8a86d8ef-88c7-4103-a36a-96624abf4fc6"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-rce9e792ec65c3ed994537d060734044e-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\", \"digests\": [\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199450\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-5e6931838b29b8c5-01"
                },
                "startTime": "2026-05-08T00:17:17Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://28b67042251421deb3924eebfdaf87fd485c3d52f69799d157d2becab870eb14",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:24Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://982987f75ba6b7714166f15d02e34f8637a9829b987816cca8621c9f867751d7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:24Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:24Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://03b726936741ae600d67f60c5b338805ba1356e4363f5da51b614806ffe365a5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:24Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:24Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fdad0e1e53828cc960d99e5442bbf0842ca50cb9a1557dcd7e7cf60e09184511",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:29Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:25Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\", \"digests\": [\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199450\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://1ff622ece0c36853c88e4a2b4a9b90be04977bd83d031f98a34163245ec6a812",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:30Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\\\", \\\"digests\\\": [\\\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778199450\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199450\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://cea10812a7f6f56cf7161698ee7dd628636aba3773829b5098695918dd941681",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:31Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778199450\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:31Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/c34015d7-9cb3-46fe-8081-53467d9384a2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-49b0216520137eec-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-kwnfh-apply-tags",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "163508",
                "uid": "c34015d7-9cb3-46fe-8081-53467d9384a2"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:22Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:22Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-kwnfh-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-49b0216520137eec-01"
                },
                "startTime": "2026-05-08T00:17:17Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://203879dd7e2d5d96ed3bcd27edfbeca0454c6fb243389f8f1b35864a7ef4df8f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:22Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:21Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d",
                                "--digest",
                                "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/f257bf8c-54b6-458f-b98f-217e4538755c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-df0eac3bb290638d-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:15:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-kwnfh-build-container",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "161126",
                "uid": "f257bf8c-54b6-458f-b98f-217e4538755c"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "frontend"
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.9@sha256:681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:50Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:50Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-kwnfh-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        "entryPoint": "buildah-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:a7d81cd41f87a748609ac5262398d56bbc84701ace189e6eb50a1ca299eddb36"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-df0eac3bb290638d-01"
                },
                "startTime": "2026-05-08T00:15:36Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://aa544bba10ac0cf33fd28c11892a0f7e2dae28ebdccbd3f2c14e3425ceb5d1f1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:46Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3c8f30092da588d88da8c617dddb271dfdb271189f118a94807cf45c4f6776ef",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:25Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ac0f9f66ea9ff0eeec81eb1ea8aa2725f88f908ec47f99250a08ace30edff0e6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:33Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:26Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://145adfaa9145b8afb770d03456f215d5a562ddaff5643e7fd015f738e16d6745",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:39Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ee47b52acda1716310356fa5d95b37a6e7d7401e33f62f398258a524ed65c3e6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:44Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:40Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://48d6981c59abb6b08344e9ce00d8d78729f6156bc9bac308560272851c0d4245",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:49Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:a7d81cd41f87a748609ac5262398d56bbc84701ace189e6eb50a1ca299eddb36\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "frontend"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "mathwizz-frontend-on-pull-request-kwnfh-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/f8975427-3beb-4d02-871a-956f3059b868",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-d71f830088ebc26f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:16:51Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-kwnfh-build-image-index",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "162804",
                "uid": "f8975427-3beb-4d02-871a-956f3059b868"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:03Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:03Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-kwnfh-build-image-index-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-d71f830088ebc26f-01"
                },
                "startTime": "2026-05-08T00:16:51Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0745b96827280b3dc78710361603a9c6f75ba7ca4557064af557d0726bfc0b46",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:59Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5c1a7a7cd84fe21cdaf88a5e54ee91ddbcb28b17f85d1d2a76ac935ecde36d12",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:00Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0c93aa77948cc8d99d0ffaa14f540965d9596676e99820c0ef57535fac1c48a4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:03Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:00Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d@sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"mathwizz-frontend-on-pull-request-kwnfh-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/73d6aef5-09f2-4698-95a0-004fa52c0e9e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-b91c65ed4ec0fc3e-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-kwnfh-clair-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "163698",
                "uid": "73d6aef5-09f2-4698-95a0-004fa52c0e9e"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:28Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:28Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-kwnfh-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\", \"digests\": [\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\":\"sha256:d655e8d7dbd8b4a63b3de51e14fd334bef383833e4d3ef5872cf00fc684e8017\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:17:28+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-b91c65ed4ec0fc3e-01"
                },
                "startTime": "2026-05-08T00:17:17Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://36b9a765d022b5d059f97bd03bf1319dd32332b3f33121b88661a9115adb347d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:23Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:0a5b8bafb8d002ec1bd9e5c935ee63829df0a30b840686be799b30d483a6aaa2",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://574b87f73e17f0b4fb1a16737956b00ea541a26d25e68b9eac59f91a276dcab9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:25Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f71eb1e80b9a5eb486c33c4ebda54f0d8d9f9089538b2402f5276ccd40524f71",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:27Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:25Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7c6f06726ed0f43969212bc9585a88ec97bfd7061b120e87f8559b07109693fe",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:28Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\\\", \\\"digests\\\": [\\\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\\\":\\\"sha256:d655e8d7dbd8b4a63b3de51e14fd334bef383833e4d3ef5872cf00fc684e8017\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:28+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:28Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/24cb33d0-e8d5-4b48-9182-89eb4641df8d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-1aa98d6ccade2a69-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-kwnfh-clamav-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "164046",
                "uid": "24cb33d0-e8d5-4b48-9182-89eb4641df8d"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:49Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:49Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-kwnfh-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\", \"digests\": [\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778199464\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-1aa98d6ccade2a69-01"
                },
                "startTime": "2026-05-08T00:17:17Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:1093f897c407e60cfcee4e4c0ae43189c30a8a2b6a03d940487de8e7e1f5fb9b",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9a7b44ae05b0bf4bff34c5dab8cccb225128ccd4e0e865b4d6203d62410aaf86",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:44Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\\\", \\\"digests\\\": [\\\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778199464\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://de298124a2c6fc6343284ab23721345463845be8e1f8cd506a5a2fc3071c990c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:49Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\\\", \\\"digests\\\": [\\\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778199464\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/00b363b7-25c5-4f2e-aab7-9eedc1b315df",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-3b4a5698fbe2565d-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:14:52Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-kwnfh-clone-repository",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "157546",
                "uid": "00b363b7-25c5-4f2e-aab7-9eedc1b315df"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                    },
                    {
                        "name": "revision",
                        "value": "face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-yfzzov"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:15:24Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:15:24Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-kwnfh-clone-repository-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        "entryPoint": "git-clone-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778199273"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "face45e"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-3b4a5698fbe2565d-01"
                },
                "startTime": "2026-05-08T00:14:52Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c21a9eb623c13ec3058a11c432d3e303bb7b3f5f4b5e6260b389b309e41d90e6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:02Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1},{\"key\":\"commit\",\"value\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199273\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"face45e\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cbacd49ed6b35ea2f289373f96ef8191e9fdf57daaa1ffcf14d7ff127182c707",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:03Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1},{\"key\":\"commit\",\"value\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199273\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"face45e\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:03Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0b4801f0d4a7916ec176df983e0722e2c81f58590d1ae3c9eba2247f7152aaa0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:23Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e\",\"type\":1},{\"key\":\"commit\",\"value\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199273\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"face45e\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:04Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/db32281f-b802-4282-9da2-415be43218eb",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-c160fff88ef7d562-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:14:47Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-kwnfh-init",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "156680",
                "uid": "db32281f-b802-4282-9da2-415be43218eb"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:14:52Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:14:52Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-kwnfh-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-c160fff88ef7d562-01"
                },
                "startTime": "2026-05-08T00:14:47Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://421d867e727f21a299f0315a312c223a1d730ffe66c64a2dfaf021707d149074",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:51Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:51Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/d4f99511-2657-4998-86a7-35d2702ac6d6",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-0ad166150ea9e9a2-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:15:24Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-kwnfh-prefetch-dependencies",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "158047",
                "uid": "d4f99511-2657-4998-86a7-35d2702ac6d6"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-yfzzov"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:15:35Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:15:35Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-r001bb0029edccda21af3ca5954d82815-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-0ad166150ea9e9a2-01"
                },
                "startTime": "2026-05-08T00:15:24Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://93904a585629ae035826f70437f0639aafb4d88593cd9f6e7845e03af586543e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:30Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c963bf772dfeaaccd8df686a911892391d03441367811955fc1baee1ccf21b00",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:30Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3234cae58c57b541657cd3183c65285bdbbf0a5c0ee12e65ef81fb2986174d0f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:34Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://22cf9685548e08d4921356d719c139a6e5d8ce872ee552539a95ef8cc4d40ba6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:35Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:35Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/2abd43bf-fa57-4c5d-82e9-0bce25f7d1f1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-a0d215bd132e8ad5-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-kwnfh-push-dockerfile",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "163709",
                "uid": "2abd43bf-fa57-4c5d-82e9-0bce25f7d1f1"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "frontend"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:29Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:29Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-kwnfh-push-dockerfile-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        "entryPoint": "push-dockerfile-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:33ef6edb3afd4941e3c8fbf44537dc25efecaba08c954ddd4f7753a515caf074"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-a0d215bd132e8ad5-01"
                },
                "startTime": "2026-05-08T00:17:18Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b12a1ecf0ce73e59dd9f220368e1770252d630f8590b8cfc2a9dc79202381988",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:25Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e6d7109474f0906a0a7340d685acdad865c0aca5306152071f3e35904f3fb6d1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:28Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:33ef6edb3afd4941e3c8fbf44537dc25efecaba08c954ddd4f7753a515caf074\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:25Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                "frontend",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d",
                                "--image-digest",
                                "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/3f6150ec-cff0-4fe7-b365-49fdf132c8d9",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-ee8c4ac213dc4414-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-kwnfh-rpms-signature-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "163771",
                "uid": "3f6150ec-cff0-4fe7-b365-49fdf132c8d9"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-kwnfh-rpms-signature-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\", \"digests\": [\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:17:31+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-ee8c4ac213dc4414-01"
                },
                "startTime": "2026-05-08T00:17:17Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fd12429bf746ff878476248a40d99e653b64900de40ec5ce7e0ee2bd67f71769",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:30Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e50a666fde40c0e4e6c0a06ac0d784433f169a363be512b45f21fb91546c2bf2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:31Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d\\\", \\\"digests\\\": [\\\"sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:31+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:31Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/c7f3f242-b9ca-428d-a96f-cf3e1bffc51f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-18825221335560c4-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-kwnfh-sast-shell-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "163751",
                "uid": "c7f3f242-b9ca-428d-a96f-cf3e1bffc51f"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-kwnfh-sast-shell-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        "entryPoint": "sast-shell-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"2026-05-08T00:17:29+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":9,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-18825221335560c4-01"
                },
                "startTime": "2026-05-08T00:17:17Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e5eeeda5d074ae804257ca10d576f426272a57e58cda53b1e13d60059f9d7f64",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:26Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://19677d5e659877434db195cb84c8f3c62af14ff6c918284b8f8bb028ffcf9104",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:29Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:29+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:26Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5670958300f656aa5a70b9df0ebba724d386e6853f0b898883da570960a2d63a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:31Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:29+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:30Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/075f41df-ecfc-4984-aa23-001598912a3f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-58b525a995dc5398-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-kwnfh-sast-snyk-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "163793",
                "uid": "075f41df-ecfc-4984-aa23-001598912a3f"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:32Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:32Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-kwnfh-sast-snyk-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        "entryPoint": "sast-snyk-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-08T00:17:31+00:00\",\"note\":\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-58b525a995dc5398-01"
                },
                "startTime": "2026-05-08T00:17:17Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2a07449eb5a14bc310ee95d420078171dd5f59ff099a7e38fbfd20325e8084b1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:29Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:26Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2cfb769fee9f05e51e3ba7d02352309877a0837d160fc2f8c5879940f123d465",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:31Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:31+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e17193be63dfa1dae3674e096be0ee62e2249ef3d9e25fbd02b2f0b4ae07f10a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:32Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:31+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:32Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262 \u003e\u003estdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/var/workdir\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) |\n    csgrep --mode=json --strip-path-prefix=\"source/\" \\\n      \u003esast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003efiltered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if ((total_files \u003e 0)); then\n    coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n    --set-scan-prop snyk-scanned-files-success:\"${supported_files}\" \\\n    --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n    filtered_sast_snyk_check_out.json \u003esast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e\"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check-oci-ta\" sarif \"$RESULT_SARIF\" || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check-oci-ta success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n  if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach to ${IMAGE_URL}\"\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/commit_sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yfzzov",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-kwnfh",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78/records/a34b91f6-20df-45cf-ad75-5471d2579200",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"face45e4cb38baebc623380e71076fa3ddfe7f5d\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/416007ab-75f2-44e3-ac95-e729318e6f78",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c6dc866aec6f76833239eddb324101fa-bbd7fba7af0d3ca7-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931534071",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "face45e4cb38baebc623380e71076fa3ddfe7f5d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-kwnfh",
                    "tekton.dev/pipelineRunUID": "416007ab-75f2-44e3-ac95-e729318e6f78",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-kwnfh-sast-unicode-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-kwnfh",
                        "uid": "416007ab-75f2-44e3-ac95-e729318e6f78"
                    }
                ],
                "resourceVersion": "164981",
                "uid": "a34b91f6-20df-45cf-ad75-5471d2579200"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:18:42Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:18:42Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-kwnfh-sast-unicode-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:18:40+00:00\",\"note\":\"Task sast-unicode-check-oci-ta success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c6dc866aec6f76833239eddb324101fa-bbd7fba7af0d3ca7-01"
                },
                "startTime": "2026-05-08T00:17:17Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cc34cc39dd3e10ad5e517dc08cefa2cec37d9128bd639c8dbdec40ebe49e3090",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:25Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2d7f290290d27dbe415dd27c181815f4f86e21798c5318701891a6ef7689ca23",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:18:41Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:18:40+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:26Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0473d279ca8020cf271d11fcab0a126ee4ab8b04d695b06eb18341604c4ff116",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:18:42Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:18:40+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:18:41Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:67f31402ac69ba18675c9ac0d60fdee00b9a060a2dae10186f3ed5a36f98b50e=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-face45e4cb38baebc623380e71076fa3ddfe7f5d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:9d35e454fd1eb53d24d385e9bbd252e9ea718a4772ac312a1acd0c3552f59907"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/af3e7107-53ab-4b2c-8cc0-cd67c283ebab",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-8e01e025c82b7d91-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:55Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-hi1bf2570b98f8938014a23eb659225587-rpms-signature-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "163497",
                "uid": "af3e7107-53ab-4b2c-8cc0-cd67c283ebab"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:21Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:21Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-hi1bf2570b98f89380c15605d9579a4d5fc2e9679febd2de7e-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\", \"digests\": [\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:17:20+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-8e01e025c82b7d91-01"
                },
                "startTime": "2026-05-08T00:16:55Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fd06337dfaf5b7956716f44b215dd17987e7472016ce596f83b7c988e8d2c44a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:19Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fbca40bf124bfa8e1368a9b844f7105663c3c6eb49160dadba1d1f94c162ef8b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:20Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\\\", \\\"digests\\\": [\\\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:20+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:20Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/aa303d83-cd37-49cf-b678-4c81edf1735f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-6392c46a51765593-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:55Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-his1bf2570b98f8938014a23eb659225587-sast-unicode-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "164878",
                "uid": "aa303d83-cd37-49cf-b678-4c81edf1735f"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:18:39Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:18:39Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-his1bf2570b98f89380657bebd61f44653f88b21ea3abc4df2-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:18:37+00:00\",\"note\":\"Task sast-unicode-check-oci-ta success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-6392c46a51765593-01"
                },
                "startTime": "2026-05-08T00:16:55Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0171e50ed8f2d6008c7112b5a70e0dc773065c4e377eb69870f056ef8091ac25",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:18Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3df7a626c6c90f1910bfaae20a24b9db5b95d1a37a13fab1c3f6459d4f85fd84",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:18:37Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:18:37+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:19Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cf2e37ff44a56a6263dcb0506f48f2615b42cb2c99e46b0dfe0c96c8b44a7e8c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:18:39Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:18:37+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:18:37Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/6a1aaeac-df16-4b8e-a532-5941a90599c9",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-a87430dad6bb11f5-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:55Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-8xv8d-apply-tags",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "162165",
                "uid": "6a1aaeac-df16-4b8e-a532-5941a90599c9"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:00Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:00Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-8xv8d-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-a87430dad6bb11f5-01"
                },
                "startTime": "2026-05-08T00:16:55Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://156bfaab081ad4c6b2b9a5dd37039ab1f9d206c372487798aca8c72c129d7719",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:59Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:59Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498",
                                "--digest",
                                "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/180ea9f0-c3f8-4f96-9414-a42ccf1656f8",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-f3fad102d00670f9-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:15:38Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-8xv8d-build-container",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "159950",
                "uid": "180ea9f0-c3f8-4f96-9414-a42ccf1656f8"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "history-worker"
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.9@sha256:681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:38Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:38Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-6f72905d7b1f4e57dcef20190425e350-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        "entryPoint": "buildah-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:bbc411a96ed9856891554c776e12f488dfe3f3870590e32f16718fab650570fb"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-f3fad102d00670f9-01"
                },
                "startTime": "2026-05-08T00:15:38Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://02b3109cbce227a30baf2ab88e53a6b75765ae8baab0c6bd84e5a5a53e7cfc3e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:46Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://81b98399f20497521055f437b15edf2edf1a9a7e716d2b3cba9dc781775d6cab",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:20Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:46Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dff578ac56bbe53b89d4748a08ccb5ef41a6443bdece62f8059b45bdeb94d089",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:27Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6e1c98663cef5a5949083be935e2dde4a65c4a82278c4af378309c9e5f302f59",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:29Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:27Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://527cdde2b4ed5c9f8e8b9c633ab03b79c9db471603af1f0963248bea6c6699a3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:33Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d88abfafd98a076898be46095621e7e8f24e92003b19c3ae17dcd97b7854ac06",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:37Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:bbc411a96ed9856891554c776e12f488dfe3f3870590e32f16718fab650570fb\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:34Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "history-worker"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "7c59667ed4010282ea9cd6698303d92717713498"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "mathwizz-history-worker-on-pull-request-8xv8d-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/e02ac966-51da-48c1-92e2-93ca9f28df65",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-c51dc64095d2293b-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:39Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-8xv8d-build-image-index",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "161847",
                "uid": "e02ac966-51da-48c1-92e2-93ca9f28df65"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:54Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:54Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-acd7d0825b2f98a8cbd5a4e075604642-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-c51dc64095d2293b-01"
                },
                "startTime": "2026-05-08T00:16:40Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2f449a1d721485e4f69d983e6175ee84b60963f3682feff1f124da58d0df2a3c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:50Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://12b395796e1006106c456d770f2865560d69a28cb960dc807c1b467eef496bc8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:50Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://03dba9fbe6548a12a6071f5ded3839b23e134d57e4bc9c47b88330b3e65496f6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:53Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498@sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"mathwizz-history-worker-on-pull-request-8xv8d-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/1a9e1cc2-3d79-4251-86f4-71bfcfbc2adc",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-90179f4725c23e29-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:54Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-8xv8d-clair-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "162755",
                "uid": "1a9e1cc2-3d79-4251-86f4-71bfcfbc2adc"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:07Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:07Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-8xv8d-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\", \"digests\": [\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\":\"sha256:37cefb7d46eef014c0ec2a70f532d8848733e402ef1a5d44d4443e98fc82fa55\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:17:06+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-90179f4725c23e29-01"
                },
                "startTime": "2026-05-08T00:16:54Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1b400976cca957c1d04508bf51956ef3f1df47d78312d32f786d139c8633fe0a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:01Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:0a5b8bafb8d002ec1bd9e5c935ee63829df0a30b840686be799b30d483a6aaa2",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d61d68624b78445e4497bde882daf1ddb3c828d88268353f3545af8c6eacf796",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:03Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://541c6d8d3411e4d81d048b1398393f015e31fe6fa4fb34be164a9b8ebd816dc8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:05Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9092e76460126963a909965186b490f1d841cdc6c8b9dc56c0ea7c4055c68170",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:06Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\\\", \\\"digests\\\": [\\\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\\\":\\\"sha256:37cefb7d46eef014c0ec2a70f532d8848733e402ef1a5d44d4443e98fc82fa55\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:06+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/da7b5804-9d68-4b47-89d0-5fb8d6b34a79",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-2c1ed612424495db-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:55Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-8xv8d-clamav-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "163214",
                "uid": "da7b5804-9d68-4b47-89d0-5fb8d6b34a79"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:18Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:18Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-8xv8d-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\", \"digests\": [\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778199435\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-2c1ed612424495db-01"
                },
                "startTime": "2026-05-08T00:16:55Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:1093f897c407e60cfcee4e4c0ae43189c30a8a2b6a03d940487de8e7e1f5fb9b",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b6fbd82831b4b02a4fae88f1bfc3e687381dfaa5225af5e8453229f49808ef46",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:16Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\\\", \\\"digests\\\": [\\\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778199435\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c7b2e18e178b4c721bf871bd6bbd3915ba50b0cd6bcdf3681714c35e13cb3103",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:17Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\\\", \\\"digests\\\": [\\\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778199435\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:16Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/9446a442-99aa-4742-917b-72a84d676683",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-57095baca64fd719-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:14:47Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-8xv8d-clone-repository",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "157634",
                "uid": "9446a442-99aa-4742-917b-72a84d676683"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                    },
                    {
                        "name": "revision",
                        "value": "7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-zqgkzb"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:15:25Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:15:25Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-51323c2190d5f8a95990e4fb14f4feb4-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        "entryPoint": "git-clone-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778199268"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "7c59667"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-57095baca64fd719-01"
                },
                "startTime": "2026-05-08T00:14:47Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a33301c95abda38cdddf87f0470cacb7cd97508c78f5ba11d9ea4dca8053e6bf",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:58Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1},{\"key\":\"commit\",\"value\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199268\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"7c59667\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b03378ba0d3aee4a3fc9442569e6c8384226f8ef1ff4b08ed8469e618e818949",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:58Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1},{\"key\":\"commit\",\"value\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199268\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"7c59667\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8cb56bcb9754edec4d58c371874575b421bf99144c22c29a5aff43ae30a267c0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:24Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3\",\"type\":1},{\"key\":\"commit\",\"value\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199268\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"7c59667\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:59Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "7c59667ed4010282ea9cd6698303d92717713498"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/ad2860fb-7bb5-4704-805a-4d7f5353a52f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-f17cb907d67a399a-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:14:41Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-8xv8d-init",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "156477",
                "uid": "ad2860fb-7bb5-4704-805a-4d7f5353a52f"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:14:47Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:14:47Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-8xv8d-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-f17cb907d67a399a-01"
                },
                "startTime": "2026-05-08T00:14:41Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e201110d4d06ea9df243b9419a21a2aed60040ee193be18246cbf91297980e48",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:46Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:46Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/99f64e14-2edf-4561-8a5c-87bc4176ec32",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-1ea71013c2b296b0-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:55Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-8xv8d-push-dockerfile",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "162488",
                "uid": "99f64e14-2edf-4561-8a5c-87bc4176ec32"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "history-worker"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:04Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:04Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-8475f3a7d35eb0e50b1c4ef3d65f9416-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        "entryPoint": "push-dockerfile-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:3a5d69973262ae9dad0b078d3beccd67474b1783c7b8b810656642901f054381"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-1ea71013c2b296b0-01"
                },
                "startTime": "2026-05-08T00:16:55Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fd948c7e9b99651bdaec1663bf46fab767426586a694c90345caea067893a326",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:03Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://93865937dc5f3fb36042141c4aa4be567d5b9a8019aef324886dad207f817a8e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:03Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:3a5d69973262ae9dad0b078d3beccd67474b1783c7b8b810656642901f054381\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:03Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                "history-worker",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498",
                                "--image-digest",
                                "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/37eddb13-5a05-40b8-947b-14c379c93d0a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-f2de29c508eeb21a-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:55Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-8xv8d-sast-shell-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "163622",
                "uid": "37eddb13-5a05-40b8-947b-14c379c93d0a"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:25Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:25Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-c0dea45abdbe5e6ff1b479df00b17165-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        "entryPoint": "sast-shell-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"2026-05-08T00:17:09+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":9,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-f2de29c508eeb21a-01"
                },
                "startTime": "2026-05-08T00:16:55Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://70b33d9405b54dfbb540b615eb98b463135e082cf157d24d51ac9fbd92620cee",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:05Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://47b6de2da97d3aae1708f7d5fa58bd69c7402d71a536af163e792821ba9bf80b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:09Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:09+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0ca42d89d2afaed6818019c90b64f680a9fdd39e1b6b104be5b5974d6c6d17ba",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:25Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:09+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:10Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/fae92d2e-2553-4807-b952-cb26a3124678",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-916d39ea051977ad-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:54Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-8xv8d-sast-snyk-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "162756",
                "uid": "fae92d2e-2553-4807-b952-cb26a3124678"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:07Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:07Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-b4c880cf8538738539d716bbad9beb4a-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        "entryPoint": "sast-snyk-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-08T00:17:06+00:00\",\"note\":\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-916d39ea051977ad-01"
                },
                "startTime": "2026-05-08T00:16:55Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://77a74c7579901eb28fadc13e81b2939942e2d2376a33d3ec55a50fdb5528104d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:04Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d9f47866142fdede9f2d5ee9cfb1837e14b35cdaf9e56ab62b2ea9bd63937ec3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:06Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:06+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:05Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1c1faf74dc068239663b5fc9452c580288d2305704a9c393a4c4ee7b013724b1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:07Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:06+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:dd443e9229019b9bfc39eaae34542da9548dc57df0c39e35e74325900f0164d3=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262 \u003e\u003estdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/var/workdir\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) |\n    csgrep --mode=json --strip-path-prefix=\"source/\" \\\n      \u003esast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003efiltered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if ((total_files \u003e 0)); then\n    coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n    --set-scan-prop snyk-scanned-files-success:\"${supported_files}\" \\\n    --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n    filtered_sast_snyk_check_out.json \u003esast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e\"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check-oci-ta\" sarif \"$RESULT_SARIF\" || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check-oci-ta success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n  if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach to ${IMAGE_URL}\"\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/commit_sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zqgkzb",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-8xv8d",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9/records/3626285f-ec2a-4d6e-8082-1900e50fef8b",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"7c59667ed4010282ea9cd6698303d92717713498\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bf22770df5fa0996fa40b16247ce83ae-323db3e0dde64b5d-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:54Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931527392",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "7c59667ed4010282ea9cd6698303d92717713498",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-8xv8d",
                    "tekton.dev/pipelineRunUID": "37cfc200-9f59-4dad-8da9-fcc3c597cad9",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull61ecdc70bb8c26e62a9d9f645200e297",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-8xv8d",
                        "uid": "37cfc200-9f59-4dad-8da9-fcc3c597cad9"
                    }
                ],
                "resourceVersion": "162740",
                "uid": "3626285f-ec2a-4d6e-8082-1900e50fef8b"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:05Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:05Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-a7b7db6dd31ecaaf6eab6ae8e7dddd44-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\", \"digests\": [\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199424\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-bf22770df5fa0996fa40b16247ce83ae-323db3e0dde64b5d-01"
                },
                "startTime": "2026-05-08T00:16:54Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://bba2b6e682d90f7181bf8cd1c3a930083280d030434759b8523bf7ac78573896",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:01Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://9cf3e026a50545066ad6e9d8b782a12bfb21d62f0771d437db439937000bb40d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:02Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5c484ded2d01882644826ddaef74e10d695315c85230b41d95249971fdb64709",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:02Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:02Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cb030b2d3c34479ff960689afa06e4f0650241cf445fe92014dd0c56db2dd2cc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:04Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\", \"digests\": [\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199424\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://3696556c08ac445b78cdf8ea6269f99c96d73c6e128de6659d03d2e64755aaca",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:04Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498\\\", \\\"digests\\\": [\\\"sha256:0ae159db72ca67adf37bc651eb9e957d4f7d4464f3bce8f29d220aeeaeab47f1\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778199424\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199424\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://779f7e3f14223192e4b020e103760b2071ec14abc173c43e2eb9da2e681444b6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:05Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778199424\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:05Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-7c59667ed4010282ea9cd6698303d92717713498"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/a4de13fd-40a2-479c-bd7b-16373f83a464",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-5ed5170b0f17f979-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-req54608ba631d395a28f17915c5796c3ea",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "162500",
                "uid": "a4de13fd-40a2-479c-bd7b-16373f83a464"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:04Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:04Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pullebf331a9578a5a8df1370877083671d9-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\", \"digests\": [\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199423\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-5ed5170b0f17f979-01"
                },
                "startTime": "2026-05-08T00:16:44Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://41c11c9538cc222d894f95a201a65a3b3e52f53522698e1ff80aea96f84821cd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:59Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://a146ef37c73640f26a00c1c2a876475d3865e479516cdde869f6d407e84b7629",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:59Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3bc3fc503e82ecf23516cdad795ad16503ce95d016940b5e48cbc29b47cca5c4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:00Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:00Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2057e715f2b247d2eaa145e380e2ed43b7896ae8549bdc400d7ab2bc85b40534",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:03Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\", \"digests\": [\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199423\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://cb79670b4ada2637ae883b3f8fbb3474afb8e3bce52185493877afaf16e72946",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:03Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\\\", \\\"digests\\\": [\\\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778199423\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:03Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199423\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://1bcd7acee4af6ff91282ca08e1a1dcee4f79194dfeead5cd8d4d4b2fd083c22c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:04Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778199423\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:04Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/fcc2da9b-b3e4-4ab0-bd94-8a709af26159",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-44a8538d6afb4cb8-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-5tq5p-apply-tags",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "161124",
                "uid": "fcc2da9b-b3e4-4ab0-bd94-8a709af26159"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:50Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:50Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-5tq5p-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-44a8538d6afb4cb8-01"
                },
                "startTime": "2026-05-08T00:16:44Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8f62b016a8c3efcd18e4f8dd481421b5729c5b278bc2c60917bb9212dba4ea0b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:50Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:48Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                                "--digest",
                                "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/da773814-24cd-4513-adbe-c89bf63f1e40",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-dd8860c4522612e5-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:15:22Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-5tq5p-build-container",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "159232",
                "uid": "da773814-24cd-4513-adbe-c89bf63f1e40"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "web-server"
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.9@sha256:681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:29Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:29Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-5tq5p-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        "entryPoint": "buildah-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:55401d6db3ad08a9c111e13a44ccc56a0df5617f4799d2747f62a1c3c9dcf9b1"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-dd8860c4522612e5-01"
                },
                "startTime": "2026-05-08T00:15:22Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0f7832077ab5ebd06b0ae4d8838457399e430b9cdac82055709744000646d8db",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:32Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://95156cf1561b529213d3a8e3ab7cf67a1a15c22706966bc3664f1ca166778ae9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:10Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://00144e5c86cdb4bcaecc2d5666c0ee71f4717643e6580236226f26ad40f612a8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:16Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://13b5f0ce58d48104f69b06555e2fcb1106b87f19949218cd8f406a6735bb6cd2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:19Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e0ad057e221e1c0afdfee11f1734ab8ca33b7e9492020e622775241cfa57059b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:24Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e38d08a1cd266ab7df03f2faa2e8f5bc07dec59ff1f116990666e029ee2c6aa9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:28Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:55401d6db3ad08a9c111e13a44ccc56a0df5617f4799d2747f62a1c3c9dcf9b1\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:25Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "web-server"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "mathwizz-web-server-on-pull-request-5tq5p-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/896eb8a7-3c73-453a-82f6-22bc20b394b0",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-29b073abe748b732-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:29Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-5tq5p-build-image-index",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "160821",
                "uid": "896eb8a7-3c73-453a-82f6-22bc20b394b0"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:43Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:43Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-5tq5p-build-image-index-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-29b073abe748b732-01"
                },
                "startTime": "2026-05-08T00:16:29Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b537b09ecf159698a1bcc39d4d6cf4eeb3c0c1430014bc2cd7eb7e21e18cd505",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:37Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7a1e023ca61556f5b86df72b2f904fb58b8b047fc36b1da555d8ece84619a0ef",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:37Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9398277087ad3d0a0875280a395990520541c49f27a8f6585d30cd7730d475a9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:40Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:38Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33@sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"mathwizz-web-server-on-pull-request-5tq5p-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/841f9b48-2d81-403b-a424-6200082d9f3a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-cd3ddb17f0f1396c-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:44Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-5tq5p-clair-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "162438",
                "uid": "841f9b48-2d81-403b-a424-6200082d9f3a"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:03Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:03Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-5tq5p-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\", \"digests\": [\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\":\"sha256:db0f6852e883fc8fc536a013fba4f4e9c83501111a94439a9bd906b6086804e1\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:17:02+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-cd3ddb17f0f1396c-01"
                },
                "startTime": "2026-05-08T00:16:44Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e39e349cc937cf21fb2675986fb2f6838e196cfb1ac199f46f56d407eed6f349",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:58Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:0a5b8bafb8d002ec1bd9e5c935ee63829df0a30b840686be799b30d483a6aaa2",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0e6ed6d97dd66cd8a5f092fdb07b0a04a4760dcff2b89683b9b2d36edf469eee",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:00Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://aa031a10c3d87580001506ef79dc33b07e57ea3fcc572d68602f250fca6f4bf3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:02Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://71571dbb0b6bf6544f152300dda1a2f967f0c4cdc397391b505a637de5c51cf3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:03Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\\\", \\\"digests\\\": [\\\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\\\":\\\"sha256:db0f6852e883fc8fc536a013fba4f4e9c83501111a94439a9bd906b6086804e1\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:02+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:02Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/0df7178e-a59d-4738-8585-7eff9edf4ad9",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-74b36f504b18dfb6-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:44Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-5tq5p-clamav-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "163269",
                "uid": "0df7178e-a59d-4738-8585-7eff9edf4ad9"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:18Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:18Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-5tq5p-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\", \"digests\": [\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778199422\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-74b36f504b18dfb6-01"
                },
                "startTime": "2026-05-08T00:16:44Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:1093f897c407e60cfcee4e4c0ae43189c30a8a2b6a03d940487de8e7e1f5fb9b",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://be7e76b925cc902d80698dfd11ffee473cc707ada07cd63099b242d8ec6d13c5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:03Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\\\", \\\"digests\\\": [\\\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778199422\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://82c11fd52880754211de72c9b0797438e84fe1d1f3b5ca5cca61dcb71c063b5e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:18Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\\\", \\\"digests\\\": [\\\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778199422\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:03Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/5fcbdbfd-5b3e-48c1-86e1-36275e7c701a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-c3dac4a015dc193f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:14:37Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-5tq5p-clone-repository",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "157156",
                "uid": "5fcbdbfd-5b3e-48c1-86e1-36275e7c701a"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                    },
                    {
                        "name": "revision",
                        "value": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-fsdrek"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:15:10Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:15:10Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-5tq5p-clone-repository-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        "entryPoint": "git-clone-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778199259"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "85d80d7"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-c3dac4a015dc193f-01"
                },
                "startTime": "2026-05-08T00:14:37Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2e63bdfa8efd0338fbcf20c906710b713e39357999ab756f9a4e57ebf55c379e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:49Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1},{\"key\":\"commit\",\"value\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199259\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"85d80d7\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:44Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a8ec3b842c553a011f3c863fa2759720dbc4ce3f9dab68cca3c20992c343c121",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:49Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1},{\"key\":\"commit\",\"value\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199259\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"85d80d7\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2db611d913618068786e2350760362626514c380ac4c5c29e3defb1b7c68fdaf",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:09Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08\",\"type\":1},{\"key\":\"commit\",\"value\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199259\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"85d80d7\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/07618323-0d62-4709-9b2e-9265b1449bdb",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-0b48e1c3db337aa1-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:14:31Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-5tq5p-init",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "155888",
                "uid": "07618323-0d62-4709-9b2e-9265b1449bdb"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:14:37Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:14:37Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-5tq5p-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-0b48e1c3db337aa1-01"
                },
                "startTime": "2026-05-08T00:14:31Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c3954dbb7158ff9c907cf878dec3215d02d8423dcb2a954e5e6e96c818be6089",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:36Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:36Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/44212e2c-3145-4c36-be71-75fb600fa933",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-e7d7c4a30d495d5e-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:15:11Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-5tq5p-prefetch-dependencies",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "157497",
                "uid": "44212e2c-3145-4c36-be71-75fb600fa933"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-fsdrek"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:15:22Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:15:22Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull273dc44279e02855127ff13b89a89057-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-e7d7c4a30d495d5e-01"
                },
                "startTime": "2026-05-08T00:15:11Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5569fcce459d474f0c1191ab4cf135ca8572253650f8dc5998e128a7ded55485",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:17Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d2b990b2c92aef926bed26870c40bae0e25563c7bd70d46ac2508ff45f5d4920",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:17Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1ff72d7041c335f08d821101721ba706aa900e00ddf931bccafe7e22e771c103",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:20Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f5561caf8de5b3117060033c2393606fcbbb16f8fec9db78b86eff61e7776422",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:21Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:21Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/b9443f5a-0b1d-412b-977a-56104e1fa324",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-f65c57c382b3cf0a-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-5tq5p-push-dockerfile",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "161917",
                "uid": "b9443f5a-0b1d-412b-977a-56104e1fa324"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "web-server"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:55Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:55Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-5tq5p-push-dockerfile-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        "entryPoint": "push-dockerfile-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:917e946fff1d286ddc32dc687c6b945a787eaf4e161b3175b94a27817d8ee35f"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-f65c57c382b3cf0a-01"
                },
                "startTime": "2026-05-08T00:16:44Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://56fdb344e11b61a95040569bde0bd6c3d0c19c9883fc60ffd60ccc0a63753f20",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:53Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1557dcc3243b30b29d2e4078983ace8b3b69e07d833d25c672feb8d9dbb59534",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:54Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:917e946fff1d286ddc32dc687c6b945a787eaf4e161b3175b94a27817d8ee35f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:53Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                "web-server",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                                "--image-digest",
                                "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/e0de7f75-7a14-4f75-adee-39c4b7e72961",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-cfebf9157db6bdb6-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-5tq5p-rpms-signature-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "161990",
                "uid": "e0de7f75-7a14-4f75-adee-39c4b7e72961"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:57Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:57Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull680cff8d722c6f639c8fe0e3b6c131b4-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\", \"digests\": [\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:16:56+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-cfebf9157db6bdb6-01"
                },
                "startTime": "2026-05-08T00:16:44Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b3a5b212f1eb944468446b288dc0c74f063a29598fbbbc91c48d00f447def31a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:55Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://35d131fc8dfa3ad80f0fb2bce86c5f799dd06b5a4cdeaabbf9d80001f8f432bd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:56Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33\\\", \\\"digests\\\": [\\\"sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:56+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:56Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/4261a02d-29a1-48a5-9c65-eca045f337fe",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-9dc72702895812bb-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-5tq5p-sast-shell-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "162759",
                "uid": "4261a02d-29a1-48a5-9c65-eca045f337fe"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:08Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:08Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-5tq5p-sast-shell-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        "entryPoint": "sast-shell-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"2026-05-08T00:17:06+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":9,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-9dc72702895812bb-01"
                },
                "startTime": "2026-05-08T00:16:45Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2dd7411fcc7c22d489e34f826130e9af7cb4bc9bc2c8da8c1b15298adca81a4b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:02Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2e09fb674f93ea6bd68748a10336e1ce9b923b6e05a22613f6d8c742663a366d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:06Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:06+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://466ef1b9d6015d980b03dca043726838c76eb61f6c7754a6aa6b97dfd96833bc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:07Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:06+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/c3f46604-bbcf-4d56-94db-810b575b9cb4",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-5f32651d72fa1547-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:44Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-5tq5p-sast-snyk-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "162491",
                "uid": "c3f46604-bbcf-4d56-94db-810b575b9cb4"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:04Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:04Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-5tq5p-sast-snyk-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        "entryPoint": "sast-snyk-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-08T00:17:03+00:00\",\"note\":\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-5f32651d72fa1547-01"
                },
                "startTime": "2026-05-08T00:16:44Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://176fad10fa89f06cca25f9510b94711b90101f91a0c6592d0aa8a9eb26ba3a59",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:01Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a2cfdb87d5d1fd9c5ae0601f717d947eb2a36b3e6c6e7450ce2c6b3774682481",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:03Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:03+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2dd36edf50f288fafbd6fc6809eefdc8a50adc48d7953ce4453de03ab24a994d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:03Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:03+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:03Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262 \u003e\u003estdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/var/workdir\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) |\n    csgrep --mode=json --strip-path-prefix=\"source/\" \\\n      \u003esast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003efiltered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if ((total_files \u003e 0)); then\n    coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n    --set-scan-prop snyk-scanned-files-success:\"${supported_files}\" \\\n    --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n    filtered_sast_snyk_check_out.json \u003esast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e\"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check-oci-ta\" sarif \"$RESULT_SARIF\" || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check-oci-ta success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n  if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach to ${IMAGE_URL}\"\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi?rev=85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/commit_sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fsdrek",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-5tq5p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi/commit/85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-qwmtfi",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d/records/d73f8727-9374-4937-a2d9-944902af7bab",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-qwmtfi\",\"commit\":\"85d80d7fc380500e269bcc5fed3cfe0a0af98f33\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/6251bb13-accb-4459-ad33-edbbd62db08d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-67abb44fc252685aea1afceada7836c3-157d0acc56cf782f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931512029",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "85d80d7fc380500e269bcc5fed3cfe0a0af98f33",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-qwmtfi",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-5tq5p",
                    "tekton.dev/pipelineRunUID": "6251bb13-accb-4459-ad33-edbbd62db08d",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-5tq5p-sast-unicode-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-5tq5p",
                        "uid": "6251bb13-accb-4459-ad33-edbbd62db08d"
                    }
                ],
                "resourceVersion": "164548",
                "uid": "d73f8727-9374-4937-a2d9-944902af7bab"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:18:22Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:18:22Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull0407dd021e1acb8361a7736c7d8fd61c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:18:21+00:00\",\"note\":\"Task sast-unicode-check-oci-ta success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-67abb44fc252685aea1afceada7836c3-157d0acc56cf782f-01"
                },
                "startTime": "2026-05-08T00:16:44Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bd6e007ca4d30cce731e259424164044130feb41c86c32de5b18e5a3cbca5d7f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:00Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f335ec165f310bd92ef7c9835bbc4cf4448c46cd4b0e44e552f02833d1df3574",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:18:21Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:18:21+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8d16b20cf9f1f46ed14ce672bfff70d41b852eb726ba9c55911827f5b1b92e96",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:18:22Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:18:21+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:18:21Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a2f4cc0ddd43477f6a0f664b4e52514e2c5aec2854c0b542be62e831105aca08=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-85d80d7fc380500e269bcc5fed3cfe0a0af98f33"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ac2a7e154a3102cd51fdfa8f8ed6b046ae08e72e18ece16364a2d639f220db74"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/8692ef29-2c24-4bc6-9f01-1f0561d72e5d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-3761f8bbc3829bf4-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mat8a9dd06807940be41651c1f96937dade-deprecated-base-image-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "163927",
                "uid": "8692ef29-2c24-4bc6-9f01-1f0561d72e5d"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:42Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:42Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mat8a9dd06807940be41651c1f91864b95a694aecb3fa9996d7bd3f3774-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\", \"digests\": [\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-08T00:17:42+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":2}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-3761f8bbc3829bf4-01"
                },
                "startTime": "2026-05-08T00:17:01Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b78f6e19c46e10daa41c08d9af53cbb7717cc82cdfe0db27e76ee879dc5cf2d2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:42Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\\\", \\\"digests\\\": [\\\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:42+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":2}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/f11a1b24-f797-4787-8e1a-09729c71cc98",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-41027bf31fd48769-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:38Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mat9f6e8d20c8890e8e8bd00091b0e37b66-deprecated-base-image-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "161589",
                "uid": "f11a1b24-f797-4787-8e1a-09729c71cc98"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:53Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:53Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mat9f6e8d20c8890e8e8bd00091ffa96fe1012fc51e97a32a53458bdd28-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\", \"digests\": [\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-08T00:16:52+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":2}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-41027bf31fd48769-01"
                },
                "startTime": "2026-05-08T00:16:38Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e8546e438771c174a6088a22bee980756a0faad3a829484b880ff2ba09b617e4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:52Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\\\", \\\"digests\\\": [\\\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:52+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":2}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:44Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/07759520-3f2c-4d14-aca0-323cf14cf7ad",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-e9230e1734c7e785-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "matfcf0752a2808ccbbcef835349c2efbbb-deprecated-base-image-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "160978",
                "uid": "07759520-3f2c-4d14-aca0-323cf14cf7ad"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:49Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:49Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "matfcf0752a2808ccbbcef83534235cf4de3fa96a95eed7b991edd05d01-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\", \"digests\": [\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-08T00:16:48+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":2}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-e9230e1734c7e785-01"
                },
                "startTime": "2026-05-08T00:16:36Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0cf7bf6eb638afe3af9c70124f8e79b0899ed79e324b1550f2a83a0d29380cb8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:48Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\\\", \\\"digests\\\": [\\\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:48+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":2}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:41Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/a48669e2-5066-492f-8efe-4569fbf5a977",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-7ad99d08b8a518d7-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:15:15Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-9f6e8d20c8890e8e8bd00091b0e37b66-prefetch-dependencies",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "157626",
                "uid": "a48669e2-5066-492f-8efe-4569fbf5a977"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-srcysp"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:15:25Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:15:25Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-9f6e8d20c8890e8e8b773577b94d41c63617932ab66097d3d4-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-7ad99d08b8a518d7-01"
                },
                "startTime": "2026-05-08T00:15:15Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c51beab743d52daadee321373eef40e9092034323a5c73309dbbc926c90d4a5a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:20Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://59f59322fd3753daf40f6391a0bb7f9ca442bcc4b0ecf7e7964ff697416f83f7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:20Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://46d874a909f2a2e622bb6cd76534e890499be8250b8108a2350938e6bf527e73",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:24Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5e30c2d5eafd856044346fac4c1a64d9894d7cf9f65a29bcc8e4361a69771883",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:25Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:24Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/8ea65edd-4e0a-4e88-afe7-a14bdece4680",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-051cf58977104878-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-reque4dfc3a12f0012662fa78903503315616",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "162924",
                "uid": "8ea65edd-4e0a-4e88-afe7-a14bdece4680"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:15Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:15Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-rdf7f60b71abe42fa9151eedd5e974e9d-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\", \"digests\": [\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199433\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-051cf58977104878-01"
                },
                "startTime": "2026-05-08T00:17:01Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://e6885149fcedddaa45352aaf060f51c2498d00cdf507129b2952ce13250ec168",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:08Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://7e5b0a94b052f8b33f467c76a09ae3048da00e0e355f2115c675c62e9c59d45f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:08Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:08Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6473dd2c5fb8676e03c8abca2d82bfd4e65f618310750d4dbfd0aad629971fc8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:08Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:08Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://58d1066187641d07398306c1f678da9a887c9ace0926e5e00990eb4686681076",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:13Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:08Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\", \"digests\": [\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199433\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://6504fb26b40dd1319320a04eeff8a55f6ccbe6fda02c55c7b77552bdd5398d94",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:13Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\\\", \\\"digests\\\": [\\\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778199433\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199433\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://ac3e6a6d29072c8337daffb9726fbd41a4f9bb545e638074ed38648e14e19ee0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:14Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778199433\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:14Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/2b34dcec-eb41-4399-9a75-b9190c6bfb5f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-2769a13d76d742fe-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-nndrf-apply-tags",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "162720",
                "uid": "2b34dcec-eb41-4399-9a75-b9190c6bfb5f"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:06Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:06Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-nndrf-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-2769a13d76d742fe-01"
                },
                "startTime": "2026-05-08T00:17:01Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0cdfaedf17f5198ec1a5d7091aabf182f4100081b9d75b56a9fa8be7f0924301",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:06Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                                "--digest",
                                "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/c91b4368-ea6b-49c2-9768-3460f6f94703",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-79481c03286c180b-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:15:39Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-nndrf-build-container",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "161008",
                "uid": "c91b4368-ea6b-49c2-9768-3460f6f94703"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "frontend"
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.9@sha256:681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:48Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:48Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-nndrf-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        "entryPoint": "buildah-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:e48849cacd6627f7585977417099cabafc7f424eef2e8ddf2e935ec96e93bd33"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-79481c03286c180b-01"
                },
                "startTime": "2026-05-08T00:15:39Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://92f07d832f80dc3efb5be84f722c50e70f132b04e3e0a86b92ae944af69bea2f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:46Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://43eaf4055ef15c6efd678a263724a1bc50fc7e0b7d6180df562769118ed5a5ac",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:25Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://75cd4e7f28d956b44934cb9eefb185843c39441002d8d6881bf6024fcb351666",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:31Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:25Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://668e56464edf73761c765f9b9ccba60f4b0f43fd9e6bf164c21731567197afa2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:37Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3abbe69d936e5ef51ea7abfa424292cfe544a48e491f6b016317cb817737f89b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:42Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5d9bc8fd35bdc25e29cd0a3c659df56df1560f0d616d757e89b8dc2f798c8532",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:47Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:e48849cacd6627f7585977417099cabafc7f424eef2e8ddf2e935ec96e93bd33\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:43Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "frontend"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "mathwizz-frontend-on-pull-request-nndrf-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/da04907e-b895-4cc1-99f3-23bd6e48e187",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-6c2e2af5d0eed3c9-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:16:49Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-nndrf-build-image-index",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "162344",
                "uid": "da04907e-b895-4cc1-99f3-23bd6e48e187"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:01Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:01Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-nndrf-build-image-index-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-6c2e2af5d0eed3c9-01"
                },
                "startTime": "2026-05-08T00:16:49Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://01a1a5ce32deaac19f0b581b418746e3b5572d38d195bdad7ae78e68af03e979",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:57Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bb1a62f1b96da6b9239bab6d239e036a3a8fbcdd9e016898ef3cae65d32836e9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:58Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5ca53b03a0a203c26117ea1dc412ba46fc8215ad4d708319cea6eaa582bb6e8d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:00Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9@sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"mathwizz-frontend-on-pull-request-nndrf-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/49320fa7-3f0f-41ad-b216-dfb1d32136bd",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-69af45ee505b9f75-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-nndrf-clair-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "163579",
                "uid": "49320fa7-3f0f-41ad-b216-dfb1d32136bd"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:24Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:24Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-nndrf-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\", \"digests\": [\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\":\"sha256:b2ec1df82852963ee83af998f67a661545d2dbb94632f6559917e5bc235b8420\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:17:23+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-69af45ee505b9f75-01"
                },
                "startTime": "2026-05-08T00:17:01Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fb6dfd55d606e3ac235537122e05df71be716dbc6d1478b7a209ae7943f57777",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:11Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:0a5b8bafb8d002ec1bd9e5c935ee63829df0a30b840686be799b30d483a6aaa2",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://841ecc790e9a8018097c95d886fb62ed22617eb16b623a17674e43431fa6bdf2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:21Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0d023e3f01edd38a28d7f30b505ded1e720ae15d5a19d2f4d8c4fb15f112e0eb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:22Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c73ba5ee9dee623794d271fcdbdde1ea13428822c4462efe1ae505631113158f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:23Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\\\", \\\"digests\\\": [\\\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\\\":\\\"sha256:b2ec1df82852963ee83af998f67a661545d2dbb94632f6559917e5bc235b8420\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:23+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:23Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/70766d65-cd17-437e-8c3b-23c9a6530065",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-e88c4b2b2b3ce870-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-nndrf-clamav-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "163767",
                "uid": "70766d65-cd17-437e-8c3b-23c9a6530065"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-nndrf-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\", \"digests\": [\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778199444\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-e88c4b2b2b3ce870-01"
                },
                "startTime": "2026-05-08T00:17:02Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:1093f897c407e60cfcee4e4c0ae43189c30a8a2b6a03d940487de8e7e1f5fb9b",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://733e1c6391e7cd31ea9ae289ae7f341115a19363b6f0fc42b78ee9ede26d91cb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:24Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\\\", \\\"digests\\\": [\\\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778199444\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9bce0ed407e5be847c0b32026a8674e76e235839ec0bf326c62549e6305963b8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:30Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\\\", \\\"digests\\\": [\\\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778199444\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:25Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/ec06893b-19f7-447a-a55c-ea3c0be85f92",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-7addc04ee4b23b7d-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:14:54Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-nndrf-clone-repository",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "157723",
                "uid": "ec06893b-19f7-447a-a55c-ea3c0be85f92"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                    },
                    {
                        "name": "revision",
                        "value": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-gytmng"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:15:26Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:15:26Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-nndrf-clone-repository-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        "entryPoint": "git-clone-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778199277"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "181cf2a"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-7addc04ee4b23b7d-01"
                },
                "startTime": "2026-05-08T00:14:54Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://971c646dd8c1250cc17eb5819e3899cfd3344a969de24f0703a9175da57dadd6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:05Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1},{\"key\":\"commit\",\"value\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199277\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"181cf2a\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ec9d41405c5290238a83bea324e339d12b3d51e0040724b09ba4bee0b76aa971",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:05Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1},{\"key\":\"commit\",\"value\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199277\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"181cf2a\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:05Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ec17d5199a0a9a72d2a3dab1364dcffce6952b0c7fb129ea62ab5aeb517d3e8a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:25Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb\",\"type\":1},{\"key\":\"commit\",\"value\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199277\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"181cf2a\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/e7be933a-bc14-4703-a748-d3167d52ac52",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-1afc9ef84e805962-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:14:50Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-nndrf-init",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "156755",
                "uid": "e7be933a-bc14-4703-a748-d3167d52ac52"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:14:54Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:14:54Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-nndrf-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-1afc9ef84e805962-01"
                },
                "startTime": "2026-05-08T00:14:50Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://617c5b10b7b44a9e542e439228e8f4735a0431667eee623eb014dfec7efab462",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:53Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:53Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/4eb42ee5-bfd8-409b-8d12-dadfcffb9e25",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-9dd317a9341d1abb-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:15:27Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-nndrf-prefetch-dependencies",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "158166",
                "uid": "4eb42ee5-bfd8-409b-8d12-dadfcffb9e25"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-gytmng"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:15:38Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:15:38Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-rf68b4b733dab08f1ace8ac573e8287b2-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-9dd317a9341d1abb-01"
                },
                "startTime": "2026-05-08T00:15:27Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://38350cfc08ed59d00a631a1a1f2b673cdd6fc0f1a07c909afd115e64bb8ded9f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:33Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e5300ce77e6be7a4e89ea8aca793a287b95a4b40d5e3e01c37b40c400e51ab54",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:33Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f833ea7c1e94a9e19e8a2b64417349f6f6a0bc22be8f30940a7a5cb437713013",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:37Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7319d154d4c6220878b9c8f4d7e14d2f50de9613235d965367d804587228a8ac",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:38Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:38Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/f4186d83-6bc6-44d3-987d-118d00d85266",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-c39436f3cead3707-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-nndrf-push-dockerfile",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "162837",
                "uid": "f4186d83-6bc6-44d3-987d-118d00d85266"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "frontend"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:12Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:12Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-nndrf-push-dockerfile-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        "entryPoint": "push-dockerfile-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:af1e0c7cce0d4032e69ca1b3dfc22f0379f2f6f96f20a4dd225932a1db664db2"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-c39436f3cead3707-01"
                },
                "startTime": "2026-05-08T00:17:02Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4e4563794c6afb8defd60db46809986f42d857b676f7613eddcacd6812f45093",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:09Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b08a26da509ddfc41a0e8e411470548af9a014fffc5a70bd212c26e019e18a35",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:11Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:af1e0c7cce0d4032e69ca1b3dfc22f0379f2f6f96f20a4dd225932a1db664db2\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:10Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                "frontend",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                                "--image-digest",
                                "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/54eb2d82-2898-4c4d-93aa-606c0a991683",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-a72a05604dd6d95b-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-nndrf-rpms-signature-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "163557",
                "uid": "54eb2d82-2898-4c4d-93aa-606c0a991683"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:24Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:24Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-nndrf-rpms-signature-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\", \"digests\": [\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:17:23+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-a72a05604dd6d95b-01"
                },
                "startTime": "2026-05-08T00:17:01Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4092f2099fc67e27ff5b936c6e20f9a4ff3966d44608dc09fa4913ff73685947",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:23Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d7a25ce03c95c0697034ab6a69d1aa2590e62d3a46a9be9f73602bb4ee13ff5c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:23Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9\\\", \\\"digests\\\": [\\\"sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:23+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:23Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/32485e8d-d6f8-41dc-be6a-9f84bca5399d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-00231e49fc45a067-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-nndrf-sast-shell-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "163559",
                "uid": "32485e8d-d6f8-41dc-be6a-9f84bca5399d"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:24Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:24Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-nndrf-sast-shell-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        "entryPoint": "sast-shell-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"2026-05-08T00:17:18+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":9,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-00231e49fc45a067-01"
                },
                "startTime": "2026-05-08T00:17:01Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6a52f0cd4a2afa034055ed9afc9299ca067367288a339953282d138f6d3f0966",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:14Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ea80e27f882b78720f7f8f82605932f040bd6b3482a7927cbdb30dcf91a27aa6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:18Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:18+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0a9a17256cef3e002237f6c9bb2d3748789647d324adc491b8179bfe27498844",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:23Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:18+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:18Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/38a1ba4a-a4ff-4622-a984-e5101102b755",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-5c949f326632871f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-nndrf-sast-snyk-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "162965",
                "uid": "38a1ba4a-a4ff-4622-a984-e5101102b755"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:16Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:16Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-nndrf-sast-snyk-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        "entryPoint": "sast-snyk-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-08T00:17:15+00:00\",\"note\":\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-5c949f326632871f-01"
                },
                "startTime": "2026-05-08T00:17:01Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dcb89c5c48c423e0c7e328770ef6096d5815a02c2963b6e251727d02507c8bbe",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:13Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5ba32f8be7a4de6f23ba36c8ec92abdd826ee88cee25ba2b301a8e2336cfd346",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:15Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:15+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:14Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d082700d4c4e7c0c3c744a0ada39a2213e39a0c7ca122eb74a129ece63553192",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:15Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-08T00:17:15+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:15Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262 \u003e\u003estdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/var/workdir\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) |\n    csgrep --mode=json --strip-path-prefix=\"source/\" \\\n      \u003esast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003efiltered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if ((total_files \u003e 0)); then\n    coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n    --set-scan-prop snyk-scanned-files-success:\"${supported_files}\" \\\n    --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n    filtered_sast_snyk_check_out.json \u003esast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e\"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check-oci-ta\" sarif \"$RESULT_SARIF\" || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check-oci-ta success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n  if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach to ${IMAGE_URL}\"\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/commit_sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gytmng",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-nndrf",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b/records/331ae41f-f290-493b-bf9e-b725af6c32e0",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"181cf2ac37f19ac4f93bf29f581cc1f5231378f9\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/98ab0222-2515-45fd-8d58-802b4243593b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8545da250ec80d8db83e0be917505016-f0557fc6f6bb3cc6-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-08T00:17:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931539691",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "181cf2ac37f19ac4f93bf29f581cc1f5231378f9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-nndrf",
                    "tekton.dev/pipelineRunUID": "98ab0222-2515-45fd-8d58-802b4243593b",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-nndrf-sast-unicode-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-nndrf",
                        "uid": "98ab0222-2515-45fd-8d58-802b4243593b"
                    }
                ],
                "resourceVersion": "164713",
                "uid": "331ae41f-f290-493b-bf9e-b725af6c32e0"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:18:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:18:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-nndrf-sast-unicode-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:18:29+00:00\",\"note\":\"Task sast-unicode-check-oci-ta success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8545da250ec80d8db83e0be917505016-f0557fc6f6bb3cc6-01"
                },
                "startTime": "2026-05-08T00:17:01Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c30c8e3b92faf3804829d9f1a1d0c6a40d067517fa267cc4b13f66a490c48c34",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:13Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3b4e0c223f1786c79dd1ce3daa5645694c6171e5f2a24c2ecc336de2ac410bb6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:18:29Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:18:29+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:17:14Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4ddc87c431955da54a9a0e0e124a2fe5dbb5341c409c93ced4b41cf555b357de",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:18:30Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:18:29+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:18:29Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:5edd30044174e63059d28f172a6e6d55e80e1fb047c8277dd9080c1609bd42eb=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-181cf2ac37f19ac4f93bf29f581cc1f5231378f9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c861846b0be46415a93a97d7d0669b0804453e29cd0c9066ee644949323c146f"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/f8bfa0d7-f31b-49a3-935e-f566b9fdecf2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-43dd4f403e1b263d-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:38Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-hi9f6e8d20c8890e8e8bd00091b0e37b66-rpms-signature-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "161141",
                "uid": "f8bfa0d7-f31b-49a3-935e-f566b9fdecf2"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:51Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:51Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-hi9f6e8d20c8890e8e416d257a0479379ca821766eef79ff93-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\", \"digests\": [\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:16:49+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-43dd4f403e1b263d-01"
                },
                "startTime": "2026-05-08T00:16:42Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6334267251c2bf30488bd3f29e8383533c475558058eaf61052f847f2b9b596e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:48Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3f260503ce6b7c4a112caf7eda676006eb652d18a271d334299355e338601119",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:50Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\\\", \\\"digests\\\": [\\\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:49+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:49Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/032e0bd1-29af-4e6c-846a-7650f37df81d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-4c8b498faf2509cc-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:38Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-his9f6e8d20c8890e8e8bd00091b0e37b66-sast-unicode-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "164346",
                "uid": "032e0bd1-29af-4e6c-846a-7650f37df81d"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:18:11Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:18:11Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-his9f6e8d20c8890e8ac8fb67349b16c861140300bc12578f2-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:18:08+00:00\",\"note\":\"Task sast-unicode-check-oci-ta success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-4c8b498faf2509cc-01"
                },
                "startTime": "2026-05-08T00:16:38Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9b025d87b8dfc153c3741a9a9c31e86b754ccd1124bc5828fb609636806ff51c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:51Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6bd58619ac753d0a461ea61888ab3afa8b119a14e43d6adc39dee09d393d91aa",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:18:08Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:18:08+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://057f1746e199a6db3766e24ca5379df2c1d232a19efd58f974fea05fb8ca1033",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:18:10Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:18:08+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:18:08Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/f2fd0b3a-b93d-4405-8f45-b9101221fa53",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-b6b47c5c96691e5f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:38Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-d46cz-apply-tags",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "160803",
                "uid": "f2fd0b3a-b93d-4405-8f45-b9101221fa53"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:46Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:46Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-d46cz-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-b6b47c5c96691e5f-01"
                },
                "startTime": "2026-05-08T00:16:42Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://89e82fbabd314f2ee35d744db36c658f0bb0223111428487d8072076d3930985",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:45Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:44Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3",
                                "--digest",
                                "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/5dc322fe-9867-4895-8b1b-47d2a4ffc06b",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-acf7923593d4429f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:15:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-d46cz-build-container",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "159173",
                "uid": "5dc322fe-9867-4895-8b1b-47d2a4ffc06b"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "history-worker"
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.9@sha256:681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:27Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:27Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-8c1da953875cc51fad01a78edcfea416-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        "entryPoint": "buildah-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:32dce0bec15e9c6bfb2796c841e859c51f12659cf1e3453ae156f5ae535c3d88"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-acf7923593d4429f-01"
                },
                "startTime": "2026-05-08T00:15:26Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://44bd5aaa356484919409f3bdda3bd52bc6a396b84072b069c773707bfa237d0e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:36Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2e6e7deede80c908c31d5276033fe5b7fb0fa9372e267d1fcdd6b6ab927ab1a0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:09Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bdf87924e9fdb1e5d6310fed4aefbf67945c7fa60bbe4279956d30c0ca2d7c16",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:15Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f4ad886cf7660e0d157d501e11918a6d35c20fb040d82f07a62798100ff8c9ba",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:18Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:16Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6a5f0c67da4aa02a1d1d5900938a3d962a4fa637d9faf16e96374713ab09d4e5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:22Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:19Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://986b45de191700fa5fc7c0c2fe67353d384a6adebe9055ff72d5802a55ef0011",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:26Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:32dce0bec15e9c6bfb2796c841e859c51f12659cf1e3453ae156f5ae535c3d88\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:23Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "history-worker"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "f5781367495800374d9347e5ad5f07d4575efaa3"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "mathwizz-history-worker-on-pull-request-d46cz-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/5ee74c7c-c46b-4bfe-8edb-fd5647a162b3",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-e9252857338e5989-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:28Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-d46cz-build-image-index",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "160102",
                "uid": "5ee74c7c-c46b-4bfe-8edb-fd5647a162b3"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:38Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:38Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-3b883785481861fbe80fcdf4746f602c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-e9252857338e5989-01"
                },
                "startTime": "2026-05-08T00:16:28Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://449f9c0c81113cc4af1a8eb1fa36fd0b3fe4c3d65730eedd1e4498ac71f437fe",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:35Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3ff6db2f41aa28fd775be84d819ad72d9a90cb1f3fac2eb3106e1c37d67f0671",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:35Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://02f26103d48ab9c3fb10a14bfd8b33b5a4a7b643a2dc006d237e677ece4498eb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:37Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:35Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3@sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"mathwizz-history-worker-on-pull-request-d46cz-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/33e8a745-abe9-42e8-a812-96e957edfd44",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-a32ded3560ad395b-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:38Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-d46cz-clair-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "161039",
                "uid": "33e8a745-abe9-42e8-a812-96e957edfd44"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:49Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:49Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-d46cz-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\", \"digests\": [\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\":\"sha256:9642f3bb6ff79a32b6a9b39c238b38f996d0bdc4c652e266200235c97d88bf35\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:16:49+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-a32ded3560ad395b-01"
                },
                "startTime": "2026-05-08T00:16:38Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d5fdb92659212096c1407fb5e09f0b7934faf9afe2d6beb3bf940ae05c811bfc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:45Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:44Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:0a5b8bafb8d002ec1bd9e5c935ee63829df0a30b840686be799b30d483a6aaa2",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2319bb65a5f10553c0735f05d8ee56ca1ca7ce7d21f2f75aa613b0a378c30d1a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:46Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7294ba1404671010d12bd8b007866a0be4ce02cbec9c0640740fa10397b7ee95",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:48Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:46Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://708e70b878482c86fb204af5b5e39b965e3a1d12291cc924b7b7ff1b98a8bc5e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:49Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\\\", \\\"digests\\\": [\\\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\\\":\\\"sha256:9642f3bb6ff79a32b6a9b39c238b38f996d0bdc4c652e266200235c97d88bf35\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:49+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:49Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/6bca8382-166d-4e4f-bc19-19fdc217cf8d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-68696e9bf581b75c-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:38Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-d46cz-clamav-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "162400",
                "uid": "6bca8382-166d-4e4f-bc19-19fdc217cf8d"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:02Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:02Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-d46cz-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\", \"digests\": [\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778199418\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-68696e9bf581b75c-01"
                },
                "startTime": "2026-05-08T00:16:41Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:1093f897c407e60cfcee4e4c0ae43189c30a8a2b6a03d940487de8e7e1f5fb9b",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://13591528a704eb482fdbc47b824af3ea93a96bf06d375ead81f83abf2fa5faea",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:58Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\\\", \\\"digests\\\": [\\\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778199418\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:44Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://41d123e470a77254a5756688837f74e77fc7d0e880a163eae72b7b7c6fbabf60",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:17:01Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\\\", \\\"digests\\\": [\\\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778199418\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/1890a6de-a2d1-42ab-8687-615e97076ae6",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-1f77552894bc2c4f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:14:42Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-d46cz-clone-repository",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "157250",
                "uid": "1890a6de-a2d1-42ab-8687-615e97076ae6"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                    },
                    {
                        "name": "revision",
                        "value": "f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-srcysp"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:15:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:15:14Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-bf0e09a0836ed74aa26bd95c23827f45-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        "entryPoint": "git-clone-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778199264"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "f578136"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-1f77552894bc2c4f-01"
                },
                "startTime": "2026-05-08T00:14:42Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://43c12c5773a2b2065ab9bfd765849d9155fdc30aea6f72bb0b80af89eea41942",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:53Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1},{\"key\":\"commit\",\"value\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199264\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"f578136\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0b4b85fe964e377813dbecff227c77e7a342eed88d805b0f81879e78031b1044",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:53Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1},{\"key\":\"commit\",\"value\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199264\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"f578136\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dd2e2af4f7cb462c6cd58cfb475ec1e44116ca4878736ee95ff2aa86a160f6a0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:13Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018\",\"type\":1},{\"key\":\"commit\",\"value\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199264\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"f578136\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:54Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "f5781367495800374d9347e5ad5f07d4575efaa3"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/c1879386-9594-4e28-bca7-355d5ee453cf",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-95df0d888f084710-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:14:37Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-d46cz-init",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "156175",
                "uid": "c1879386-9594-4e28-bca7-355d5ee453cf"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:14:42Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:14:42Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-d46cz-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-95df0d888f084710-01"
                },
                "startTime": "2026-05-08T00:14:37Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bd60cc03f8568931dd09e0bf68c54d5c0ef05d5c20f64c7677b87f820a00dba0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:41Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:41Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/41254aae-47f8-4f41-8023-228ce2c491b8",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-e0ef05957f0579e9-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:38Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-d46cz-push-dockerfile",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "161135",
                "uid": "41254aae-47f8-4f41-8023-228ce2c491b8"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "history-worker"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:50Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:50Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-b1f80d714a1be8d62bf3792efbf2e10d-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        "entryPoint": "push-dockerfile-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d3ec1f00abd4836aae48d849d722a47ab98edbca54d66e899c60051606edfaaf"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-e0ef05957f0579e9-01"
                },
                "startTime": "2026-05-08T00:16:38Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://26640f6b12ea8440a2db43be9d494a107bd2ba091fdc03dee5949b2085367209",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:44Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9ade8ca3f7fbcbee14800c522a61d23a929e284b819f44365d761c8225135d9c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:50Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d3ec1f00abd4836aae48d849d722a47ab98edbca54d66e899c60051606edfaaf\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:49Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                "history-worker",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3",
                                "--image-digest",
                                "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/68b163d2-5d96-44a1-9e6a-f619f238e377",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-19075056ffc1ae65-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:38Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-d46cz-sast-shell-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "161897",
                "uid": "68b163d2-5d96-44a1-9e6a-f619f238e377"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:54Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:54Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-3c3ed7532f54e1caf52333461ea55f7c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        "entryPoint": "sast-shell-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"2026-05-08T00:16:52+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":9,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-19075056ffc1ae65-01"
                },
                "startTime": "2026-05-08T00:16:38Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f63cbfba9273e6169a7b78f3da4e517b37c8fd65db13fde7fb5904b77007db83",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:48Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1b0701a04376c09c8c47b6372c4c18d8ef73669c395a5996e1006685574e6618",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:52Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:52+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cdbb795ec036d53218f2825e08f6acce2238474886ffdfc8163d37e2d2c63355",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:53Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:52+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:52Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/3ef52dd6-4fdb-447c-a0a9-c43640ef0198",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-19a78a705efea65c-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:38Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-d46cz-sast-snyk-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "161196",
                "uid": "3ef52dd6-4fdb-447c-a0a9-c43640ef0198"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:51Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:51Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-3fe2d7b9533d1330feb5a43796783caa-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        "entryPoint": "sast-snyk-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-08T00:16:50+00:00\",\"note\":\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-19a78a705efea65c-01"
                },
                "startTime": "2026-05-08T00:16:38Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://32dc98de9f8d3090680bc26c0f5e1232f6931bb0bb7d748da66f40fa211848c6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:48Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://acdd157b3ba945c2821273677ff7811d39e5e91554532671ed4ab58f6af6cce6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:51Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:50+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://02604ed3207442f0f01066ea6f36a3f2032be40aac7fdb458f3b1f146a800ef8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:51Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:50+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:51Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:d56cfd83fc84b9c87bb4d347dc84815b74cfabf844827b1126f619bd80bec018=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262 \u003e\u003estdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/var/workdir\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) |\n    csgrep --mode=json --strip-path-prefix=\"source/\" \\\n      \u003esast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003efiltered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if ((total_files \u003e 0)); then\n    coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n    --set-scan-prop snyk-scanned-files-success:\"${supported_files}\" \\\n    --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n    filtered_sast_snyk_check_out.json \u003esast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e\"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check-oci-ta\" sarif \"$RESULT_SARIF\" || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check-oci-ta success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n  if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach to ${IMAGE_URL}\"\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/commit_sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-srcysp",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-d46cz",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731/records/f87e8451-e696-4b84-9f0a-27009f44bdff",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"f5781367495800374d9347e5ad5f07d4575efaa3\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-31c40c741150f73d5ecec5cb75153965-7d0498399f8ef554-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-08T00:16:38Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931519897",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "f5781367495800374d9347e5ad5f07d4575efaa3",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-d46cz",
                    "tekton.dev/pipelineRunUID": "b5b4514d-0d6b-4495-be95-458eb8e03731",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pullb0e2bd9050562e42fb2521c75c495246",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-d46cz",
                        "uid": "b5b4514d-0d6b-4495-be95-458eb8e03731"
                    }
                ],
                "resourceVersion": "161040",
                "uid": "f87e8451-e696-4b84-9f0a-27009f44bdff"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:49Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:49Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-71487656eac6eb89b7561525107a87a8-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\", \"digests\": [\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199408\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-31c40c741150f73d5ecec5cb75153965-7d0498399f8ef554-01"
                },
                "startTime": "2026-05-08T00:16:38Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://049a635189e945ccc80d5c47b785dcbf8ce5cc2e043b647fe515549c949cf85b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:45Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:44Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://8144b11fc79fe2909097f50a4a477c63b6443553359a4df9f13d7a1871965b6e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:45Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://357290a5ff8894c9ca0a2e1fc4378491a86b2ca05d2d7d80c285cc7fbf4a8de7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:46Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:46Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7ac8b24c3538c20e2b19b568e251a7dc88f06407f931b89ee6fe2135e209727d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:48Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:46Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\", \"digests\": [\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199408\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://e3ca1e3b476fbff0b1e8133bb4c1de7ab1a44c291e02256610962cc03317bdbb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:48Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3\\\", \\\"digests\\\": [\\\"sha256:2d2b3eb685522dd9d86cb356bc9ed6a0d690c1fdd0e884235febb734bc072e2a\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778199408\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199408\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://20eafe0ee1a5697d453561d963581d7f90dec7be69476c090bc3232aebc7dac3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:49Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778199408\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:49Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-f5781367495800374d9347e5ad5f07d4575efaa3"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/bdd82a5e-222a-43fd-9f05-8fdef6a73249",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-270472bbfd6048d9-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-req5ccfb13e533261da7c803625cadb9012",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "161153",
                "uid": "bdd82a5e-222a-43fd-9f05-8fdef6a73249"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:51Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:51Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull959566c1023d60862b656ae291965001-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\", \"digests\": [\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199409\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-270472bbfd6048d9-01"
                },
                "startTime": "2026-05-08T00:16:36Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://fa242a69631e7493d1c54c418ec9198f2b4e7770a5308f79832c61995e73956f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:45Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:44Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://739e640eb41a2e51b32dd4cce5e008e5a3aaedead20025a0271d2dcd98a02c57",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:45Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3f516d5ca0c1c4d4ade473e800e118a8e6e63193859d85136a8e4b4113aacdcf",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:45Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:45Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://91d9a122fee6d33ae2c934264e5d8270f41414479e4646d5dc2bd0feb960c982",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:48Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:46Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\", \"digests\": [\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199409\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://19a779e7d69cf7e68ca5cf4ef74ffc0e6bf8f08fc3f8ae1b36d96f8325880e83",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:49Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\\\", \\\"digests\\\": [\\\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778199409\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778199409\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://77a2d9a8b95804cc5b80c723e780ff0390d40fde14a12daea7a73357700a63ac",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:50Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778199409\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/106608ea-a90d-4110-baf0-9e7061035801",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-482af37799619dad-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-m86rd-apply-tags",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "160573",
                "uid": "106608ea-a90d-4110-baf0-9e7061035801"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:44Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:44Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-m86rd-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-482af37799619dad-01"
                },
                "startTime": "2026-05-08T00:16:36Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8765785f4bd631f86882916aeafeb9c7f1f5c4ecfb8d336959da4a853c565030",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:43Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:42Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                                "--digest",
                                "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/c2922147-13ce-4772-9ead-bad604c9bf6b",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-3b35ee65abcad36d-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:15:18Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-m86rd-build-container",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "159090",
                "uid": "c2922147-13ce-4772-9ead-bad604c9bf6b"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "web-server"
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.9@sha256:681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:24Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:24Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-m86rd-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        "entryPoint": "buildah-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:32f4aa9054fb88fb7006c66b55c1292facbc1e1c8d8019a2b07b5d413d3ddd2f"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-3b35ee65abcad36d-01"
                },
                "startTime": "2026-05-08T00:15:18Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a4e416701b43e94d7a6b06d5ec33cbd570e75b26ca5a836a6f74e57c7d9338e1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:28Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:24Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://461cbf4f9d734f628f1479dd98197f800130f0775ef8db7184b147f699a70bfe",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:02Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5cb53556d19ff7d6e20c23cd85ed3abdd59c0d0284a208a762690372ce82e442",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:12Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://095ab31815d5311649bfeb40750cdbcbc84766867e716fca3033ec00f36fcace",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:16Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c8bfa7423539081665707360a6e49ddda6817a79622721b47f18abc37a0812ec",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:20Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:16Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cff1cc4812b366c279e03a352857811f9f3d7f4a9d66344618cfbf3778f8742c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:24Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:32f4aa9054fb88fb7006c66b55c1292facbc1e1c8d8019a2b07b5d413d3ddd2f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:20Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "web-server"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "mathwizz-web-server-on-pull-request-m86rd-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/9eda9255-23f1-4bbd-94cc-efa9828b21cd",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-2fc8e76fa19ea9d6-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:25Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-m86rd-build-image-index",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "159811",
                "uid": "9eda9255-23f1-4bbd-94cc-efa9828b21cd"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:35Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:35Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-m86rd-build-image-index-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-2fc8e76fa19ea9d6-01"
                },
                "startTime": "2026-05-08T00:16:25Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dd6337ac2eaf2cb959b6a76241eb60532149d9a608dae4fae93caf5d11c40b1b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:32Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e890807d157fa3ddcb2a9b52c7e31cd8510d7cfd31bc59289f879336e6e4b6d5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:32Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://35e022bd1da8413dfaca4e373df44508b5a4ced487664e17f88a940d95dcf1e9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:35Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:33Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6@sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"mathwizz-web-server-on-pull-request-m86rd-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/b6b0fdb3-e89c-401f-956e-e3f8042f1da6",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-ac7d9894b2b91f34-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-m86rd-clair-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "160877",
                "uid": "b6b0fdb3-e89c-401f-956e-e3f8042f1da6"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:47Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:47Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-m86rd-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\", \"digests\": [\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\":\"sha256:ea358dc0fc66ad64ed0dc30ca6058c41996161bb4e9cc44a1d2f903da52d5600\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:16:47+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-ac7d9894b2b91f34-01"
                },
                "startTime": "2026-05-08T00:16:36Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3092587e94efe12e49ed14195fe3d49ff33abdf3435feaef0f767b88a45f6ccd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:43Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:0a5b8bafb8d002ec1bd9e5c935ee63829df0a30b840686be799b30d483a6aaa2",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://baa8f81015b032609622a89e5d56318549d06e3e28a17e01c36f11045be9ed09",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:44Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0b115dcb91ef427440e3c6b046986d35f8da2e34faaa07e64041fbcffa8804f5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:46Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a68b4b58f8c9306926b3cc918d388909bdd3e8c2e0d7979f9c30c9eccc9384a9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:47Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\\\", \\\"digests\\\": [\\\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\\\":\\\"sha256:ea358dc0fc66ad64ed0dc30ca6058c41996161bb4e9cc44a1d2f903da52d5600\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:47+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:47Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/984db8ba-174a-4d58-b561-70134582aaf3",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-a53a38cc4e2a14b7-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-m86rd-clamav-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "162229",
                "uid": "984db8ba-174a-4d58-b561-70134582aaf3"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:17:00Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:17:00Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-m86rd-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\", \"digests\": [\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778199418\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-a53a38cc4e2a14b7-01"
                },
                "startTime": "2026-05-08T00:16:36Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:1093f897c407e60cfcee4e4c0ae43189c30a8a2b6a03d940487de8e7e1f5fb9b",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bcc8b29dcdcc0262f01bf50c5d86ad8d2638a3a8e9d4c45998b4039f95e13186",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:58Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\\\", \\\"digests\\\": [\\\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778199418\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://613788618ffb5a33248d95c2410f38a8aee02488b202bbba455e64a3837e7154",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:59Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\\\", \\\"digests\\\": [\\\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778199418\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/a336f8ab-8e38-4c7b-8f15-9cd8b579ef72",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-690eca85b08bc0d4-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:14:33Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-m86rd-clone-repository",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "157041",
                "uid": "a336f8ab-8e38-4c7b-8f15-9cd8b579ef72"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                    },
                    {
                        "name": "revision",
                        "value": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-zeikzl"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:15:06Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:15:06Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-m86rd-clone-repository-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        "entryPoint": "git-clone-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778199255"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "1afc7f7"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-690eca85b08bc0d4-01"
                },
                "startTime": "2026-05-08T00:14:33Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9e10c721732fc6a76cd4428e0c703cf8998863713709505ee06024c5c91f3596",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:44Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1},{\"key\":\"commit\",\"value\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199255\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"1afc7f7\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:39Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0eabd21e67694f20541f69c15dab9f6c849f54ecb4b9df9d45ad3742181938ff",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:45Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1},{\"key\":\"commit\",\"value\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199255\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"1afc7f7\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://da7ef5c5fc90ecd60d42d87077fff02f311526bb3760061f96457ec0f1cd809b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:05Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353\",\"type\":1},{\"key\":\"commit\",\"value\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778199255\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"1afc7f7\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:46Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/eaac878b-e016-4795-8362-d1f0f7226287",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-d4a54dc895d9c941-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:14:28Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-m86rd-init",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "155570",
                "uid": "eaac878b-e016-4795-8362-d1f0f7226287"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:14:33Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:14:33Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-m86rd-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-d4a54dc895d9c941-01"
                },
                "startTime": "2026-05-08T00:14:28Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3fa03143ab80bb3b738ccfa9c5c793433f85ae5fb431012fc8e84691b3218d22",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:14:32Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:14:32Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/b5e72260-3ab6-499f-9c20-864cb611a238",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-b4a55887f351ea01-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:15:06Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-m86rd-prefetch-dependencies",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "157373",
                "uid": "b5e72260-3ab6-499f-9c20-864cb611a238"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-zeikzl"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:15:17Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:15:17Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull1257ed21f71e978d39586161dffcd024-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-b4a55887f351ea01-01"
                },
                "startTime": "2026-05-08T00:15:07Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1247d8949c2f4f751474154f1ea99ab975b64e9b63a8417389bd3788deb07661",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:13Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://78be20d82d9b0508c1c172efc78c7a7bd63b6239a1d60412a76825f0a4337202",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:13Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dc6464cc3bf5ef80e12f1c18e3c04988d5a9be850b09bf52f721c749e1d126e8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:15Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c97b3257f78da984e529b111fe4e8e6525d7e6bb18113efe2c32dd36185f5a5e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:15:16Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:15:16Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/9be47caa-50d7-4185-b698-c637d4aa161d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-360d276c6c6b7be1-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-m86rd-push-dockerfile",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "160941",
                "uid": "9be47caa-50d7-4185-b698-c637d4aa161d"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "web-server"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:48Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:48Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-m86rd-push-dockerfile-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        "entryPoint": "push-dockerfile-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:d777a63d50865fdb63ac4c7055c7348a2afd8a5fcfaeb85f9aaa1005f27eaf29"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-360d276c6c6b7be1-01"
                },
                "startTime": "2026-05-08T00:16:36Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://210201fe2cebe5054b3d80bba160ff12f7c832b406fd3e5915a9fdb7661aad64",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:47Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://46e8da2bb0bb59b164a71ba1b842e0d82bf180dbaeb4fb23abf2140b8e818abc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:48Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:d777a63d50865fdb63ac4c7055c7348a2afd8a5fcfaeb85f9aaa1005f27eaf29\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:47Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                "web-server",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                                "--image-digest",
                                "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/457e04a9-c225-4591-8496-3dc4117d9957",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-9f0fbe59df2fd4d0-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-m86rd-rpms-signature-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "160932",
                "uid": "457e04a9-c225-4591-8496-3dc4117d9957"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:48Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:48Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull6224a90c8f147eaf683b29894281be41-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\", \"digests\": [\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:16:48+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-9f0fbe59df2fd4d0-01"
                },
                "startTime": "2026-05-08T00:16:36Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b740623803c349d8ffe4ddf65e92b4de613e1e7dd9664ead81bf3b984c093482",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:48Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://49099772737b41b9a169a1fda2f5a298e20acf596df96e5ab1225c976589fcb6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:48Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6\\\", \\\"digests\\\": [\\\"sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:48+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:48Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/0424a8c7-e504-42cf-ac40-564ce08f93f0",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-2a2afedeeeb5c736-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-m86rd-sast-shell-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "161264",
                "uid": "0424a8c7-e504-42cf-ac40-564ce08f93f0"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:52Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:52Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-m86rd-sast-shell-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        "entryPoint": "sast-shell-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"2026-05-08T00:16:50+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":9,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-2a2afedeeeb5c736-01"
                },
                "startTime": "2026-05-08T00:16:36Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e13e16223d486ae751c183ecd281f122b97d08a7ac3593cd10f0eaa6a7bddd3d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:46Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c92c5cb8dcc0ac6533bef471c9361466474e2acae836fa1c125dfb4e328d0932",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:50Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:50+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://14cd7f74ef3b123ff69b5f3666d47cb6844613c71dc8bc04d42194de9a75d095",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:51Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:50+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/5b23bc4c-3932-45ac-8d80-15a81ec6792f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-5d9c6d74fc16e8a0-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-m86rd-sast-snyk-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "161154",
                "uid": "5b23bc4c-3932-45ac-8d80-15a81ec6792f"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:16:50Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:16:50Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-m86rd-sast-snyk-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        "entryPoint": "sast-snyk-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-08T00:16:49+00:00\",\"note\":\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-5d9c6d74fc16e8a0-01"
                },
                "startTime": "2026-05-08T00:16:36Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://86921d1336580c5bd003c7308443e682166dbc662d0d283b3fad050c84453aa9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:48Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:44Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c8ec492b4c5bf5043f7ee99ef1fdae71a289905b993644b76ca0643650330b17",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:49Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:49+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cc03bf6e90c3d67506a8ad26a736863299a66e73e81697973a2bf352b7679d4f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:50Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-08T00:16:49+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262 \u003e\u003estdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/var/workdir\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) |\n    csgrep --mode=json --strip-path-prefix=\"source/\" \\\n      \u003esast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003efiltered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if ((total_files \u003e 0)); then\n    coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n    --set-scan-prop snyk-scanned-files-success:\"${supported_files}\" \\\n    --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n    filtered_sast_snyk_check_out.json \u003esast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e\"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check-oci-ta\" sarif \"$RESULT_SARIF\" || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check-oci-ta success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n  if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach to ${IMAGE_URL}\"\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef?rev=1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/commit_sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-zeikzl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-m86rd",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef/commit/1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-jwumef",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31/records/295f72fa-49f4-4f53-a201-f034744af1ea",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-jwumef\",\"commit\":\"1afc7f7e961a0362b035596c7b7cbcbdef482ac6\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-212c0350aeea817fe6f31f0690553209-daad980ecc574cca-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-08T00:16:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74931505027",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha": "1afc7f7e961a0362b035596c7b7cbcbdef482ac6",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-jwumef",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-m86rd",
                    "tekton.dev/pipelineRunUID": "97a4192a-ff94-486a-abbc-8d0cc461dc31",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-m86rd-sast-unicode-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-m86rd",
                        "uid": "97a4192a-ff94-486a-abbc-8d0cc461dc31"
                    }
                ],
                "resourceVersion": "164330",
                "uid": "295f72fa-49f4-4f53-a201-f034744af1ea"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-08T00:18:10Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:18:10Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pullbd70e4535ddb8a6f8107cb486dfb751a-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-08T00:18:08+00:00\",\"note\":\"Task sast-unicode-check-oci-ta success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-212c0350aeea817fe6f31f0690553209-daad980ecc574cca-01"
                },
                "startTime": "2026-05-08T00:16:36Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://394c27364e170c3e878768920b6de8760674a58e76afbca93c55fdd5325b1416",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:16:46Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e6a44af52a8d0afa41d566f65c4c80bfb1fc22fb539171c0ba9c40eeeb7e3937",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:18:08Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:18:08+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:16:46Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a44ed2d20e68b1a1970665c4cb84434bff265ba9840d28d1ce8bfb7ab33f4abc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-08T00:18:09Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-08T00:18:08+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-08T00:18:09Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:485b440be6a919c1eb542a886b11b3559fca41c539ce8ade3ce53cde8a159353=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-1afc7f7e961a0362b035596c7b7cbcbdef482ac6"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:ee55a56be40e0089b74d7148447aa99a8af1e8d2017c2d0095a718e2d10051c9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/8b58780d-d6dd-498a-8bd5-7a3ed9779d79",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-fe19ee8ea455dede-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:48:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "tesf4fc06f6309b68bd2d5e225e1d35526c-deprecated-base-image-check",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "103024",
                "uid": "8b58780d-d6dd-498a-8bd5-7a3ed9779d79"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:40Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:40Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "tesf4fc06f6309b68bd2d5e225e30db24ea7512a95676630dd498b88917-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\", \"digests\": [\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:39+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-fe19ee8ea455dede-01"
                },
                "startTime": "2026-05-07T23:48:23Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4c52b2093debe82b070a7fac5b7eb084402f6017e6d6c0598f008dc45032bfce",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:39Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\\\", \\\"digests\\\": [\\\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:39+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:28Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-73474ea3d6",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/32477925-fc6d-498e-b7d0-a0f5500ae9ee",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-a30357f9fad35adc-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:46:35Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-comp-pac-f4fc06f6309b68bd2d5e225e1d35526c-clone-repository",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "95670",
                "uid": "32477925-fc6d-498e-b7d0-a0f5500ae9ee"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://gitlab.com/konflux-qe/hacbs-test-project-integration"
                    },
                    {
                        "name": "revision",
                        "value": "9563c74c641ed57d00587689aa7c536c690dd28d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone:0.1@sha256:7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "output",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-467ca0c736"
                        }
                    },
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-oktqhp"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:46:52Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:46:52Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp-pac-f4fc06f6309b61c5c0fc07479d48440a100db62119757-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21"
                        },
                        "entryPoint": "git-clone",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "9563c74c641ed57d00587689aa7c536c690dd28d"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/hacbs-test-project-integration"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "9563c74c641ed57d00587689aa7c536c690dd28d"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778197577"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "9563c74"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/hacbs-test-project-integration"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-a30357f9fad35adc-01"
                },
                "startTime": "2026-05-07T23:46:35Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5e3eb7c9ddd7a33577b7e73b26f5a19dcee3ad0b9a47aaf213a875bac7811cec",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:46:50Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/hacbs-test-project-integration\",\"type\":1},{\"key\":\"commit\",\"value\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197577\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"9563c74\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/hacbs-test-project-integration\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:46:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1a2e217300c9b0b00ca1b7373d4bbd0188203dc724b4875ad02abf2ac8d4b94a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:46:51Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/hacbs-test-project-integration\",\"type\":1},{\"key\":\"commit\",\"value\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778197577\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"9563c74\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/hacbs-test-project-integration\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:46:51Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone Task will clone a repo from the provided url into the output Workspace. By default the repo will be cloned into the root of your Workspace.",
                    "params": [
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "source",
                            "description": "Subdirectory inside the `output` Workspace to clone the repo into.",
                            "name": "subdirectory",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Clean out the contents of the destination directory if it already exists before cloning.",
                            "name": "deleteExisting",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Deprecated. Has no effect. Will be removed in the future.",
                            "name": "gitInitImage",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://gitlab.com/konflux-qe/hacbs-test-project-integration"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "9563c74c641ed57d00587689aa7c536c690dd28d"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBDIRECTORY",
                                    "value": "source"
                                },
                                {
                                    "name": "PARAM_DELETE_EXISTING",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_GIT_INIT_IMAGE"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_OUTPUT_PATH",
                                    "value": "/workspace/output"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ] ; then\n  set -x\nfi\n\nif [ -n \"${PARAM_GIT_INIT_IMAGE}\" ]; then\n  echo \"WARNING: provided deprecated gitInitImage parameter has no effect.\"\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e \"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e \"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\n\ncleandir() {\n  # Delete any existing contents of the repo directory if it exists.\n  #\n  # We don't just \"rm -rf ${CHECKOUT_DIR}\" because ${CHECKOUT_DIR} might be \"/\"\n  # or the root of a mounted volume.\n  if [ -d \"${CHECKOUT_DIR}\" ] ; then\n    # Delete non-hidden files and directories\n    rm -rf \"${CHECKOUT_DIR:?}\"/*\n    # Delete files and directories starting with . but excluding ..\n    rm -rf \"${CHECKOUT_DIR}\"/.[!.]*\n    # Delete files and directories starting with .. plus any other character\n    rm -rf \"${CHECKOUT_DIR}\"/..?*\n  fi\n}\n\nif [ \"${PARAM_DELETE_EXISTING}\" = \"true\" ] ; then\n  cleandir\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\nif ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n  echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n  echo \"--- Git Status ---\"\n  git status\n  echo \"------------------\"\n  exit 1\nfi\n\n# Check if there are changes staged for commit\nif git diff --staged --quiet; then\n  echo \"No diff was found, skipping merge...\" \u003e\u00262\nelse\n  echo \"Merge successful (no conflicts found), committing...\"\nif ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n  echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n  exit 1\nfi\n  MERGED_SHA=$(git rev-parse HEAD)\n  echo \"New HEAD after merge: ${MERGED_SHA}\"\n  echo \"${MERGED_SHA}\" \u003e \"/tekton/results/merged_sha\"\nfi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e \"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e \"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ] ; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBDIRECTORY",
                                    "value": "source"
                                },
                                {
                                    "name": "WORKSPACE_OUTPUT_PATH",
                                    "value": "/workspace/output"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink\n  do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ] ; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ] ; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The git repo will be cloned onto the volume backing this Workspace.",
                            "name": "output"
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        },
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-73474ea3d6",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/b8c42658-8172-491f-a80c-d18e6c35c8ce",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-0fc3e2640c5d5092-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:48:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-comp-pac-f4fc06f6309b68bd2d5e225e1d35526c-sast-shell-check",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "102299",
                "uid": "b8c42658-8172-491f-a80c-d18e6c35c8ce"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check:0.1@sha256:2cd09c97b9f0fae9c7bcd26d956f77221fb7137ee8b2ef17e7351b5e6f1eb89e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-467ca0c736"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:37Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:37Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp-pac-f4fc06f6309b636314f39f01bd0cb7ff8c39cad3e59c3-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "2cd09c97b9f0fae9c7bcd26d956f77221fb7137ee8b2ef17e7351b5e6f1eb89e"
                        },
                        "entryPoint": "sast-shell-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:35+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-0fc3e2640c5d5092-01"
                },
                "startTime": "2026-05-07T23:48:23Z",
                "steps": [
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:169f73f80fbde8d54f42416c5de8cc9214ecc7e8c89c70a3385285bbac32ad0a",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b1ab99fb2416f4c9b1de8974f7b0235527b1a32e6d9bf0f3789d7b2d075bfc52",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:35Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:35+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:5da32f9d64fdb2a960792e282f739e9d398a69e4c43d7183323ea8a13b845c73",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://77797b90794c7f2329be72644fd9b27b70734ab20fbcea48fc47a763830cdeb3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:35+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:35Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.51@sha256:169f73f80fbde8d54f42416c5de8cc9214ecc7e8c89c70a3385285bbac32ad0a",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n    PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/workspace/workspace/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c \"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n    read -r quota period \u003c /sys/fs/cgroup/cpu.max\n    if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n        export SC_JOBS=$(((quota + period - 1) / period))\n        echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n    fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n    --mode=json\n    --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n    --remove-duplicates\n    --embed-context=3\n    --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n    # predefined list of shellcheck important findings\n    CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n    CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n    CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n    CSGREP_OPTS+=(\n        --event=\"$CSGREP_EVENT_FILTER\"\n    )\nelse\n    CSGREP_OPTS+=(\n        --event=\"error|warning\"\n    )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e \"$OUTPUT_FILE\"; then\n    echo \"Error occurred while running 'run-shellcheck.sh'\"\n    note=\"Task sast-shell-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n        echo \"INFO: Trying to clone known-false-positives..\"\n        git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    # build initial csfilter-kfp command\n    csfilter_kfp_cmd=(\n        csfilter-kfp\n        --verbose\n        --kfp-dir=\"${KFP_DIR}\"\n        --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n        csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    # Execute the command and capture any errors\n    set +e\n    \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e \"${OUTPUT_FILE}.filtered\" 2\u003e \"${OUTPUT_FILE}.error\"\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n        echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n        mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n        echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003e shellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-shell-check"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:6a46c5960cbcb81d9f6b0206163102d6f2e9e649ec231136f9ee33c02d3c1ad0",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n    echo 'No image-url or image-digest param provided. Skipping upload.'\n    exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n    if [ ! -f \"${UPLOAD_FILE}\" ]; then\n        echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n        continue\n    fi\n\n    # Determine the media type based on the file extension\n    if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n        MEDIA_TYPE=\"application/json\"\n    else\n        MEDIA_TYPE=\"application/sarif+json\"\n    fi\n\n    echo \"Selecting auth\"\n    select-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n    echo \"Attaching to ${IMAGE_URL}\"\n    if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\n    then\n      echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n      exit 1\n    fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-shell-check"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-73474ea3d6",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/954353d2-9573-4daf-831f-86d528aeb1e4",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-61830858b0729300-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:47:02Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-min",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-comp-pac-gf4fc06f6309b68bd2d5e225e1d35526c-build-container",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "105365",
                "uid": "954353d2-9573-4daf-831f-86d528aeb1e4"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "9563c74c641ed57d00587689aa7c536c690dd28d"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://gitlab.com/konflux-qe/hacbs-test-project-integration"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-min:0.9"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "source",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-467ca0c736"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:11Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:11Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp-pac-gf4fc06f6309b1dfbd662414762742a0e5b03f2a845ef-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "83455b969b5b0f5e8cd96708b393343123754ec01d3d3cdaf531208693978a50"
                        },
                        "entryPoint": "buildah-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo@sha256:736711e91a9be7e916c9b70659a794164be352eaf805fb549e20d177e7d30fef"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-61830858b0729300-01"
                },
                "startTime": "2026-05-07T23:47:03Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9071f4d7cc2a64d1aae549427031377b88d534e3f03ef18a57a0a1912b832a4f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:41Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:08Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6d1755e0173872073846a3f1243b3013cf860338b3839a00ff4776b1d13cd96f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:48Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2b2f14cdfee358a082350e6d86c2ca7ba197a77ba9c5e3131680af3be2d638d5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:58Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://891973c0a175979c014a47aa85bfe14e36680ad310938c175305318dff4d7355",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:05Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:47:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0dd4eea6cc36cc8e9a9f561669aee1dc192bc1aa9be78432b684f5d6650f7193",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:11Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo@sha256:736711e91a9be7e916c9b70659a794164be352eaf805fb549e20d177e7d30fef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "2Gi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "512Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "9563c74c641ed57d00587689aa7c536c690dd28d"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://gitlab.com/konflux-qe/hacbs-test-project-integration"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n  \"$source_dir_path\" | \"$source_dir_path/\"*)\n    # path is valid, do nothing\n    ;;\n  *)\n    echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n    echo \"Source path: $source_dir_path\" \u003e\u00262\n    echo \"Resolved path: $context_dir_path\" \u003e\u00262\n    exit 1\n    ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e /etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n    case $1 in\n        --build-args)\n            shift\n            # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n            # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n            # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do build_args+=(\"$1\"); shift; done\n            ;;\n        --env)\n            shift\n            # Collect env entries of the form KEY=value\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do env_vars+=(\"$1\"); shift; done\n            ;;\n        --labels)\n            shift\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do LABELS+=(\"--label\" \"$1\"); shift; done\n            ;;\n        --annotations)\n            shift\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ANNOTATIONS+=(\"--annotation\" \"$1\"); shift; done\n            ;;\n        *)\n            echo \"unexpected argument: $1\" \u003e\u00262\n            exit 2\n            ;;\n    esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e /shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n    jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"\n    then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ] ; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ] ; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/workspace/source/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e /shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/workspace/source/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n      -e 'H;1h;$!d;x' \\\n      -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n      \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null` `\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e \"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key \\\n                  -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z \\\n                  -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"\n    then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e /dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c \"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n    buildah build\n    \"${VOLUME_MOUNTS[@]}\"\n    \"${BUILDAH_ARGS[@]}\"\n    \"${LABELS[@]}\"\n    \"${ANNOTATIONS[@]}\"\n    --tls-verify=\"$TLSVERIFY\" --no-cache\n    --ulimit nofile=4096:4096\n    --http-proxy=false\n    -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e /shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "test-comp-pac-gf4fc06f6309b68bd2d5e225e1d35526c-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"\nthen\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/workspace/source/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"\nthen\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c \"/workspace/source\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/workspace/source/image-digest\"\n} \u003e \"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"\nthen\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n  [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n  [rekorInternalUrl]=REKOR_URL\n  [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n  [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n  [rekorInternalUrl]=rekorExternalUrl\n  [fulcioInternalUrl]=fulcioExternalUrl\n  [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e /shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n  then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e /tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"\n  then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\n  cyclonedx)\n    syft_sbom_type=cyclonedx-json@1.5 ;;\n  spdx)\n    syft_sbom_type=spdx-json@2.3 ;;\n  *)\n    echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n    exit 1\n    ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/workspace/source/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/workspace/source/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/workspace/source/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/source/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "10m",
                                    "memory": "128Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n    --additional-base-images)\n      shift\n      while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ADDITIONAL_BASE_IMAGES+=(\"$1\"); shift; done\n      ;;\n    *)\n      echo \"unexpected argument: $1\" \u003e\u00262\n      exit 2\n      ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/workspace/source/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/workspace/source/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/workspace/source/sbom-source.json\")\nfi\n\nif [ -f \"/workspace/source/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/workspace/source/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n  then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"\n  then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace containing the source code to build.",
                            "name": "source"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-73474ea3d6",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/73efaf92-8522-4986-b77a-e078d9671a70",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-339f832a34b981fa-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:48:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-comp-pac-gf4fc06f6309b68bd2d5e225e1d35526c-push-dockerfile",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "102007",
                "uid": "73efaf92-8522-4986-b77a-e078d9671a70"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile:0.3@sha256:359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-467ca0c736"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:34Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp-pac-gf4fc06f6309b4e79ee0b3a991fac55bc8a9fa5dbbc0f-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7"
                        },
                        "entryPoint": "push-dockerfile",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo@sha256:854cdebaa61762c8da5c6afd6ba15059790aab6606e1234074292ae84a85c153"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-339f832a34b981fa-01"
                },
                "startTime": "2026-05-07T23:48:23Z",
                "steps": [
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://204918b5a63105cca07bc7de5e2f6b8926cfa0514d159c33d8006af14f54b7d1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:33Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo@sha256:854cdebaa61762c8da5c6afd6ba15059790aab6606e1234074292ae84a85c153\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:33Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        },
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                ".",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d",
                                "--image-digest",
                                "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/workspace/workspace"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace containing the source code from where the Dockerfile is discovered.",
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-73474ea3d6",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/07cca0dc-b360-4c1c-b4aa-d84b6c4565a5",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-1e677f0c03a25c5a-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:48:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-comp-pac-gf4fc06f6309b68bd2d5e225e1d35526c-sast-snyk-check",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "102512",
                "uid": "07cca0dc-b360-4c1c-b4aa-d84b6c4565a5"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check:0.4@sha256:566753ca880764361b11f2c67d8e62dda94f829b11cb48e4716f27568216a481"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-467ca0c736"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:37Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:37Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp-pac-gf4fc06f6309b17cd0a158656090f6484bdc49e691abe-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "566753ca880764361b11f2c67d8e62dda94f829b11cb48e4716f27568216a481"
                        },
                        "entryPoint": "sast-snyk-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-07T23:48:35+00:00\",\"note\":\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-1e677f0c03a25c5a-01"
                },
                "startTime": "2026-05-07T23:48:23Z",
                "steps": [
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5782a59aac4cffb2f7b5e80fb1cc0b738a5ffb678c24504ecd52803106022a09",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:35Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:35+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4feacf4cd477a2022f4295b6f82be05f9bd0a2b94f5139b14368974cf1323ba0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:35+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:36Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n    PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262\u003e\u003e stdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/workspace/workspace\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c \"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd  \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) \\\n    | csgrep --mode=json --strip-path-prefix=\"source/\"  \\\n    \u003e sast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003e filtered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if (( total_files \u003e 0 )); then\n      coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n                      --set-scan-prop snyk-scanned-files-success:\"${supported_files}\"  \\\n                      --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n                      filtered_sast_snyk_check_out.json  \u003e sast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e \"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check\" sarif \"$RESULT_SARIF\"  || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-snyk-check"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n    if [ ! -f \"${UPLOAD_FILE}\" ]; then\n      echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n      continue\n    fi\n    if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n        MEDIA_TYPE=application/json\n    else\n        MEDIA_TYPE=application/sarif+json\n    fi\n    echo \"Selecting auth\"\n    select-oci-auth \"${IMAGE_URL}\" \u003e \"${HOME}/auth.json\"\n    echo \"Attaching to ${IMAGE_URL}\"\n    if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\n    then\n      echo \"Failed to attach to ${IMAGE_URL}\"\n    fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-snyk-check"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/c3434eed-4d44-4003-a240-d7419ba94aa2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-b617f79981b40b99-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:48:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-comp-pac-gitlab-qtyrdo-on-afe69ca068fe9ffb47acfb4f16b5ce34",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "105327",
                "uid": "c3434eed-4d44-4003-a240-d7419ba94aa2"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:49:12Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:49:12Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp-pac-gitlab-qtyrdoa50c093362ea2256704d5cae05ecacee-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\", \"digests\": [\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1778197750\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-b617f79981b40b99-01"
                },
                "startTime": "2026-05-07T23:48:23Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://6ed2308aa0aec4d2d6566ecf9a64fbcb9f30d8e6779906d0ac71f071558b1716",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:41Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://19cbed34d63cc5a736b33404ea0cf36cd56776fcab65d358617d61388ab0be6e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:42Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7e58dc7f72a29f6bd28c68121e4ab8a540f3f38dc16949e7e3d52f1b8125257b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:42Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:42Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b9456c328fa9dd7f0f84a9bc427051fe55dfc2fbc60eb43bc69a723535217508",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:49:10Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\", \"digests\": [\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1778197750\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://ebc3b90d54a95453704c94aad235674e3be919656cc7392746a597e398e3c6b7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:49:11Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\\\", \\\"digests\\\": [\\\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"1778197750\\\",\\\"note\\\":\\\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\\\",\\\"successes\\\":7,\\\"failures\\\":1,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:49:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1778197750\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://8778d87c4a02225109371eddb72a71cb8bd51dce0d060688fa2d9b78c200d464",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:49:11Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"1778197750\\\",\\\"note\\\":\\\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\\\",\\\"successes\\\":7,\\\"failures\\\":1,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:49:11Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/78049625-e5c3-403c-8770-efacea9ab31b",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-188bb265fa1d9fbd-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:48:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln-apply-tags",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "101970",
                "uid": "78049625-e5c3-403c-8770-efacea9ab31b"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:33Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:33Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp-pac-gitlab-qtyrdof2a03bf21bde61f4da280ef0c32a6fac-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-188bb265fa1d9fbd-01"
                },
                "startTime": "2026-05-07T23:48:24Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8e7c8a21b6805089eef84252f4bed43291655a090de164a785d9076c54387083",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:32Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:28Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d",
                                "--digest",
                                "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/72939ce8-baa6-4091-95a4-611b13acdd96",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-90a91b8cbd095067-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:48:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln-clair-scan",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "103900",
                "uid": "72939ce8-baa6-4091-95a4-611b13acdd96"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:46Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:46Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp-pac-gitlab-qtyrdob8e90fb47a3f8c623f1d319d476055b8-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\", \"digests\": [\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\":\"sha256:1b3ea5b5bcbf1b7df4aa231ab66b1a9975cbd21e7eee292614d6551e0aebe205\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":7,\"medium\":144,\"low\":152,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:45+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-90a91b8cbd095067-01"
                },
                "startTime": "2026-05-07T23:48:23Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5b520122080a92bc4679d5e8cbfeadd5b2e9ba23cc3aa0f68da579e4353288e3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:29Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:0a5b8bafb8d002ec1bd9e5c935ee63829df0a30b840686be799b30d483a6aaa2",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a757f93282ee8a4ed5b4aab68ad79a37c6bf7039ef2de3e2aff617fbfbab19df",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:42Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ccf8692b6eac85f49122b0185fb7da505b96e45a9c51c1766521e41bc948be75",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:44Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://70de0567289c423ddd3f7d27fdc9e4985258444c5ade0d9b5c52bc5c13421329",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:45Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\\\", \\\"digests\\\": [\\\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\\\":\\\"sha256:1b3ea5b5bcbf1b7df4aa231ab66b1a9975cbd21e7eee292614d6551e0aebe205\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":7,\\\"medium\\\":144,\\\"low\\\":152,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:45+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/a91226fe-4143-4102-b76d-6fe883a02b27",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-f8b3d26b88693f4c-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:48:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln-clamav-scan",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "106623",
                "uid": "a91226fe-4143-4102-b76d-6fe883a02b27"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:49:38Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:49:38Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp-pac-gitlab-qtyrdo9509641aae225ed2b10a9c506b32d838-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\", \"digests\": [\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778197771\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-f8b3d26b88693f4c-01"
                },
                "startTime": "2026-05-07T23:48:23Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:1093f897c407e60cfcee4e4c0ae43189c30a8a2b6a03d940487de8e7e1f5fb9b",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://44884ae78d7ea59039556ed24f00975988a7d7ce019fcdf09c4976fc79f2131f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:49:32Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\\\", \\\"digests\\\": [\\\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197771\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f3bfca1c7309f08d598b2f44bef01a387af44d4ef42bacb336a48ecc40166ed6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:49:37Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\\\", \\\"digests\\\": [\\\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778197771\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:49:32Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/4fdf6825-c4d5-4013-9f77-5da65a4cf18d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-e6aefa2a8fd59a27-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:46:29Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln-init",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "95256",
                "uid": "4fdf6825-c4d5-4013-9f77-5da65a4cf18d"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:46:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:46:34Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-e6aefa2a8fd59a27-01"
                },
                "startTime": "2026-05-07T23:46:29Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://480a0f99c5883519eb0c4604dbf368653a2c14977654d2e6ddfb25f02db72b99",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:46:33Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:46:33Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/c5c9eb74-735a-4a69-97c2-56a9d8cdc56f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-2f3f972738289de8-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:48:12Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-comp-pacf4fc06f6309b68bd2d5e225e1d35526c-build-image-index",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "100784",
                "uid": "c5c9eb74-735a-4a69-97c2-56a9d8cdc56f"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:23Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:23Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp-pacf4fc06f6309b682dfd992dbf6cc97caff57cc14409743d-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-2f3f972738289de8-01"
                },
                "startTime": "2026-05-07T23:48:12Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9130a288a02ffe59aa71ad87e623429525dee00601613d8c10d3248add33ba2c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:19Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9147b474d7f3784fc9ce40907618179779cbe5f59875aad53d77811c650e4509",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:20Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e76d0eb0b176cde4c59f3740922b13e619ff3436fdb93ed7c2eb17cdc6620a37",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:22Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:20Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d@sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"test-comp-pacf4fc06f6309b68bd2d5e225e1d35526c-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-73474ea3d6",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/25ca7a0a-7426-46cd-aeeb-30fa7a0e2a51",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-bc5f780b9978bb12-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:48:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-comp-paf4fc06f6309b68bd2d5e225e1d35526c-sast-unicode-check",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "102298",
                "uid": "25ca7a0a-7426-46cd-aeeb-30fa7a0e2a51"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check:0.4@sha256:c162d9d0cd1e4c64dfc340577ba8e6bf55ebd1bb859fe3157217de9b4473c640"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-467ca0c736"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:36Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:36Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp-paf4fc06f6309b68b40a76b5df04e25c1a938e39d47a715ab-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c162d9d0cd1e4c64dfc340577ba8e6bf55ebd1bb859fe3157217de9b4473c640"
                        },
                        "entryPoint": "sast-unicode-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:48:34+00:00\",\"note\":\"Task sast-unicode-check success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-bc5f780b9978bb12-01"
                },
                "startTime": "2026-05-07T23:48:23Z",
                "steps": [
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://11ae5f6fa0e224e32f9998d22e840db295aebc52cbec597a1a846849467195c1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:34Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:34+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7de1213b2440724716525ed142e6c24c163949b5e9ba5de0da09e3dc7e26d70b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:48:35Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:48:34+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:48:34Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/workspace/workspace"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n    PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n    \u003eraw_sast_unicode_check_out.txt \\\n    2\u003eraw_sast_unicode_check_out.log \\\n    || FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n    echo \"Failed to run find-unicode-control command\" \u003e\u00262\n    cat raw_sast_unicode_check_out.log\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n    echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n    --mode=json\n    --remove-duplicates\n    --embed-context=3\n    --set-scan-prop=\"${SCAN_PROP}\"\n    --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003e processed_sast_unicode_check_out.json 2\u003e processed_sast_unicode_check_out.err; then\n    echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n    cat processed_sast_unicode_check_out.err\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n        echo \"INFO: Trying to clone known-false-positives..\"\n        git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    # Build initial csfilter-kfp command\n    csfilter_kfp_cmd=(\n        csfilter-kfp\n        --verbose\n        --kfp-dir=\"${KFP_DIR}\"\n        --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    # Append --record-excluded option if RECORD_EXCLUDED is true\n    if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n        csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    # Execute the command and capture any errors\n    set +e\n    \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003e sast_unicode_check_out.json 2\u003e sast_unicode_check_out.error\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n        echo \"WARN: failed to filter known false positives\" \u003e\u00262\n        mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n    else\n        echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003e sast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n    note=\"Task sast-unicode-check success: No finding was detected\"\n    ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s  sast_unicode_check_out.sarif ]]; then\n    note=\"Task sast-unicode-check success: Some findings were detected, but filtered by known false positive\"\n    ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n    echo \"sast-unicode-check test failed because of the following issues:\"\n    cat sast_unicode_check_out.json\n    TEST_OUTPUT=\n    parse_test_output \"sast-unicode-check\" sarif sast_unicode_check_out.sarif  || true\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-unicode-check"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0;\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n    if [ ! -f \"${UPLOAD_FILE}\" ]; then\n      echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n      continue\n    fi\n\n    if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n        MEDIA_TYPE=application/json\n    else\n        MEDIA_TYPE=application/sarif+json\n    fi\n\n    echo \"Selecting auth\"\n    select-oci-auth \"${IMAGE_URL}\" \u003e \"${HOME}/auth.json\"\n    echo \"Attaching to ${IMAGE_URL}\"\n    retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-unicode-check"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/2d3df8ea-56f8-4668-91ab-caeeeb0a45a2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-06aa6b900d9ca8ad-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:48:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-comp-pf4fc06f6309b68bd2d5e225e1d35526c-rpms-signature-scan",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "104592",
                "uid": "2d3df8ea-56f8-4668-91ab-caeeeb0a45a2"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:48:56Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:48:56Z",
                        "message": "\"step-rpms-signature-scan\" exited with code 1: Error",
                        "reason": "Failed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp-pf4fc06f6309b68bd701b8b8e86a596b328186d4912f847a3-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-06aa6b900d9ca8ad-01"
                },
                "startTime": "2026-05-07T23:48:24Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://42e7304ae9de414e30b6333f1cd23f77271af3c557ae4cdaae59280baf61d22d",
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:48:55Z",
                            "reason": "Error",
                            "startedAt": "2026-05-07T23:48:30Z"
                        },
                        "terminationReason": "Error"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://85b65503d7db3facf25272b39d3af6ac2049eae819ba202d22624a64081e8ba9",
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:48:55Z",
                            "reason": "Error",
                            "startedAt": "2026-05-07T23:48:55Z"
                        },
                        "terminationReason": "Skipped"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/gitlab-rep-ufob/test-comp-pac-gitlab-qtyrdo:on-pr-9563c74c641ed57d00587689aa7c536c690dd28d"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:2cd90854a489b20448b7b912df0c3d8ff0b5b90a68374c28813ccc12558aab64"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/commit_sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "build.appstudio.redhat.com/pull_request_number": "17548",
                    "build.appstudio.redhat.com/target_branch": "base-gitlab-bwttoj",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-73474ea3d6",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gitlab-bwttoj",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-oktqhp",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/gitlab-rep-ufob/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-bwttoj\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/source-project-id": "56586709",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "56586709",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef/records/287e6392-a48e-448b-8ad3-d45e007cb68f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"9563c74c641ed57d00587689aa7c536c690dd28d\",\"eventType\":\"Merge Request\",\"pull_request-id\":17548}",
                    "results.tekton.dev/result": "gitlab-rep-ufob/results/37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5de1ba278977af9f10f77c61fa528003-df127b6f7f41d3aa-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-qtyrdo",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:46:52Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-lkwm",
                    "appstudio.openshift.io/component": "test-comp-pac-gitlab-qtyrdo",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-qtyrdo-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "17548",
                    "pipelinesascode.tekton.dev/repository": "test-comp-pac-gitlab-qtyrdo",
                    "pipelinesascode.tekton.dev/sha": "9563c74c641ed57d00587689aa7c536c690dd28d",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRun": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                    "tekton.dev/pipelineRunUID": "37c79592-8cc0-4697-b5f8-43b294ae91ef",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies",
                    "test.appstudio.openshift.io/pr-group-sha": "cf6e2420f9ed5f099bda49bb6da27f638a506444b994a32884e28bea83fe7c"
                },
                "name": "test-compf4fc06f6309b68bd2d5e225e1d35526c-prefetch-dependencies",
                "namespace": "gitlab-rep-ufob",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-comp-pac-gitlab-qtyrdo-on-pull-request-lpzln",
                        "uid": "37c79592-8cc0-4697-b5f8-43b294ae91ef"
                    }
                ],
                "resourceVersion": "95888",
                "uid": "287e6392-a48e-448b-8ad3-d45e007cb68f"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-qtyrdo",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies:0.3@sha256:214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "source",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-467ca0c736"
                        }
                    },
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-oktqhp"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:47:02Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:47:02Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-compf4fc06f6309b68bd2de54450ba4a6f36d3f8d3ac4ea59531a9-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f"
                        },
                        "entryPoint": "prefetch-dependencies",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies"
                    }
                },
                "spanContext": {
                    "traceparent": "00-5de1ba278977af9f10f77c61fa528003-df127b6f7f41d3aa-01"
                },
                "startTime": "2026-05-07T23:46:52Z",
                "steps": [
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e1fedbbdde2755ec8926d817dcfece3dca66c1d0c1522bd5b18e09089ec203db",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:47:01Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:46:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/workspace/source/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/workspace/source/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/workspace/source/cachi2/cachi2.env /workspace/source/cachi2/prefetch.env /workspace/source/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e /mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace with the source code, prefetch artifacts will be stored on the workspace as well",
                            "name": "source"
                        },
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "kueue.konflux-ci.dev/requests-mintmaker": "1",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "mintmaker/results/148405e8-1e67-42f5-8b80-dfb1fc1ecb3b/records/02659b90-4ecd-4700-b8f1-25991fdcd1c7",
                    "results.tekton.dev/result": "mintmaker/results/148405e8-1e67-42f5-8b80-dfb1fc1ecb3b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-049d70be8f9ff6455635d242dde90bb2-f3ecfb11f1a05adf-01\"}"
                },
                "creationTimestamp": "2026-05-08T00:00:14Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "kueue.x-k8s.io/priority-class": "konflux-dependency-update",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "mintmaker.appstudio.redhat.com/application": "build-suite-component-update-gnbh",
                    "mintmaker.appstudio.redhat.com/branch": "multi-component-child-base-vpgn",
                    "mintmaker.appstudio.redhat.com/component": "gh-multi-component-child-vpgn",
                    "mintmaker.appstudio.redhat.com/git-host": "github.com",
                    "mintmaker.appstudio.redhat.com/git-platform": "github",
                    "mintmaker.appstudio.redhat.com/namespace": "build-e2e-uftk",
                    "mintmaker.appstudio.redhat.com/repo-branch-hash": "deaad614e1ef",
                    "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_build-nudge-child-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-05080000-1c2b5946",
                    "tekton.dev/pipelineRun": "renovate-05080000-1c2b5946",
                    "tekton.dev/pipelineRunUID": "148405e8-1e67-42f5-8b80-dfb1fc1ecb3b",
                    "tekton.dev/pipelineTask": "build"
                },
                "name": "renovate-05080000-1c2b5946-build",
                "namespace": "mintmaker",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-05080000-1c2b5946",
                        "uid": "148405e8-1e67-42f5-8b80-dfb1fc1ecb3b"
                    }
                ],
                "resourceVersion": "133510",
                "uid": "02659b90-4ecd-4700-b8f1-25991fdcd1c7"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "mintmaker-controller-manager",
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05080000-1c2b5946",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05080000-1c2b5946-41f5c2cd",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05080000-1c2b5946",
                                "optional": false
                            },
                            "name": "configmap-renovate-05080000-1c2b5946"
                        },
                        {
                            "name": "secret-renovate-05080000-1c2b5946-41f5c2cd",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05080000-1c2b5946"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "emptyDir": {},
                        "name": "shared-data"
                    }
                ]
            },
            "status": {
                "completionTime": "2026-05-08T00:02:15Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:02:15Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-05080000-1c2b5946-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-05080000-1c2b5946-build-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-049d70be8f9ff6455635d242dde90bb2-f3ecfb11f1a05adf-01"
                },
                "startTime": "2026-05-08T00:00:14Z",
                "steps": [
                    {
                        "container": "step-prepare-db",
                        "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:2fcc4c7dc48eb4196d2b7ca4296caf282b8fbfa9c11e5695699e050f15abd781",
                        "name": "prepare-db",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:15Z",
                            "message": "Step prepare-db terminated as pod renovate-05080000-1c2b5946-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:20Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-prepare-rpm-cert",
                        "imageID": "registry.access.redhat.com/ubi9@sha256:edabf9436bb372addcca3537aa76111c7a1aba970f5e3b02e2e03bc72943612d",
                        "name": "prepare-rpm-cert",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:15Z",
                            "message": "Step prepare-rpm-cert terminated as pod renovate-05080000-1c2b5946-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:24Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:15Z",
                            "message": "Step renovate terminated as pod renovate-05080000-1c2b5946-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:14Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05080000-1c2b5946",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05080000-1c2b5946-41f5c2cd",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05080000-1c2b5946",
                                "optional": false
                            },
                            "name": "configmap-renovate-05080000-1c2b5946"
                        },
                        {
                            "name": "secret-renovate-05080000-1c2b5946-41f5c2cd",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05080000-1c2b5946"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "kueue.konflux-ci.dev/requests-mintmaker": "1",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "mintmaker/results/5575654f-36ee-45eb-b9a0-d612c2fa9027/records/287408c8-3d28-4881-a085-2b52f0985da8",
                    "results.tekton.dev/result": "mintmaker/results/5575654f-36ee-45eb-b9a0-d612c2fa9027",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a8848ee636ccf35bed80b4aa3abccf0a-4152eb05ea14d4ee-01\"}"
                },
                "creationTimestamp": "2026-05-08T00:00:14Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "kueue.x-k8s.io/priority-class": "konflux-dependency-update",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "mintmaker.appstudio.redhat.com/application": "build-suite-positive-mc-bzkd",
                    "mintmaker.appstudio.redhat.com/branch": "multi-component-base-sztkfa",
                    "mintmaker.appstudio.redhat.com/component": "go-component-sxekmu",
                    "mintmaker.appstudio.redhat.com/git-host": "github.com",
                    "mintmaker.appstudio.redhat.com/git-platform": "github",
                    "mintmaker.appstudio.redhat.com/namespace": "build-e2e-drue",
                    "mintmaker.appstudio.redhat.com/repo-branch-hash": "4d9636d52d3e",
                    "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_sample-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-05080000-4b6d0213",
                    "tekton.dev/pipelineRun": "renovate-05080000-4b6d0213",
                    "tekton.dev/pipelineRunUID": "5575654f-36ee-45eb-b9a0-d612c2fa9027",
                    "tekton.dev/pipelineTask": "build"
                },
                "name": "renovate-05080000-4b6d0213-build",
                "namespace": "mintmaker",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-05080000-4b6d0213",
                        "uid": "5575654f-36ee-45eb-b9a0-d612c2fa9027"
                    }
                ],
                "resourceVersion": "133476",
                "uid": "287408c8-3d28-4881-a085-2b52f0985da8"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "mintmaker-controller-manager",
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05080000-4b6d0213",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05080000-4b6d0213-37225331",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05080000-4b6d0213",
                                "optional": false
                            },
                            "name": "configmap-renovate-05080000-4b6d0213"
                        },
                        {
                            "name": "secret-renovate-05080000-4b6d0213-37225331",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05080000-4b6d0213"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "emptyDir": {},
                        "name": "shared-data"
                    }
                ]
            },
            "status": {
                "completionTime": "2026-05-08T00:02:15Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:02:15Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-05080000-4b6d0213-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-05080000-4b6d0213-build-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-a8848ee636ccf35bed80b4aa3abccf0a-4152eb05ea14d4ee-01"
                },
                "startTime": "2026-05-08T00:00:14Z",
                "steps": [
                    {
                        "container": "step-prepare-db",
                        "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:2fcc4c7dc48eb4196d2b7ca4296caf282b8fbfa9c11e5695699e050f15abd781",
                        "name": "prepare-db",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:15Z",
                            "message": "Step prepare-db terminated as pod renovate-05080000-4b6d0213-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:19Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-prepare-rpm-cert",
                        "imageID": "registry.access.redhat.com/ubi9@sha256:edabf9436bb372addcca3537aa76111c7a1aba970f5e3b02e2e03bc72943612d",
                        "name": "prepare-rpm-cert",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:15Z",
                            "message": "Step prepare-rpm-cert terminated as pod renovate-05080000-4b6d0213-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:25Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:15Z",
                            "message": "Step renovate terminated as pod renovate-05080000-4b6d0213-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:14Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05080000-4b6d0213",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05080000-4b6d0213-37225331",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05080000-4b6d0213",
                                "optional": false
                            },
                            "name": "configmap-renovate-05080000-4b6d0213"
                        },
                        {
                            "name": "secret-renovate-05080000-4b6d0213-37225331",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05080000-4b6d0213"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "kueue.konflux-ci.dev/requests-mintmaker": "1",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "mintmaker/results/6c7057bb-5c56-4f31-90a6-30865e3cba26/records/ecebfbb7-1504-4559-bcb0-ce82ee9eae74",
                    "results.tekton.dev/result": "mintmaker/results/6c7057bb-5c56-4f31-90a6-30865e3cba26",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4e8896701417aeb12fc18b32cb3902e0-8d53fac9d34beffc-01\"}"
                },
                "creationTimestamp": "2026-05-08T00:00:15Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "kueue.x-k8s.io/priority-class": "konflux-dependency-update",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "mintmaker.appstudio.redhat.com/application": "integ-app-lkwm",
                    "mintmaker.appstudio.redhat.com/branch": "base-gitlab-bwttoj",
                    "mintmaker.appstudio.redhat.com/component": "test-comp-pac-gitlab-qtyrdo",
                    "mintmaker.appstudio.redhat.com/git-host": "gitlab.com",
                    "mintmaker.appstudio.redhat.com/git-platform": "gitlab",
                    "mintmaker.appstudio.redhat.com/namespace": "gitlab-rep-ufob",
                    "mintmaker.appstudio.redhat.com/repo-branch-hash": "060b561816bd",
                    "mintmaker.appstudio.redhat.com/repository": "konflux-qe_hacbs-test-project-integration",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-05080000-4b92b4f0",
                    "tekton.dev/pipelineRun": "renovate-05080000-4b92b4f0",
                    "tekton.dev/pipelineRunUID": "6c7057bb-5c56-4f31-90a6-30865e3cba26",
                    "tekton.dev/pipelineTask": "build"
                },
                "name": "renovate-05080000-4b92b4f0-build",
                "namespace": "mintmaker",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-05080000-4b92b4f0",
                        "uid": "6c7057bb-5c56-4f31-90a6-30865e3cba26"
                    }
                ],
                "resourceVersion": "133432",
                "uid": "ecebfbb7-1504-4559-bcb0-ce82ee9eae74"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "mintmaker-controller-manager",
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05080000-4b92b4f0",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05080000-4b92b4f0-230b7dd3",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05080000-4b92b4f0",
                                "optional": false
                            },
                            "name": "configmap-renovate-05080000-4b92b4f0"
                        },
                        {
                            "name": "secret-renovate-05080000-4b92b4f0-230b7dd3",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05080000-4b92b4f0"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "emptyDir": {},
                        "name": "shared-data"
                    }
                ]
            },
            "status": {
                "completionTime": "2026-05-08T00:02:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:02:14Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-05080000-4b92b4f0-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-05080000-4b92b4f0-build-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-4e8896701417aeb12fc18b32cb3902e0-8d53fac9d34beffc-01"
                },
                "startTime": "2026-05-08T00:00:15Z",
                "steps": [
                    {
                        "container": "step-prepare-db",
                        "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:2fcc4c7dc48eb4196d2b7ca4296caf282b8fbfa9c11e5695699e050f15abd781",
                        "name": "prepare-db",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:14Z",
                            "message": "Step prepare-db terminated as pod renovate-05080000-4b92b4f0-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:19Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-prepare-rpm-cert",
                        "imageID": "registry.access.redhat.com/ubi9@sha256:edabf9436bb372addcca3537aa76111c7a1aba970f5e3b02e2e03bc72943612d",
                        "name": "prepare-rpm-cert",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:14Z",
                            "message": "Step prepare-rpm-cert terminated as pod renovate-05080000-4b92b4f0-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:25Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:14Z",
                            "message": "Step renovate terminated as pod renovate-05080000-4b92b4f0-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:15Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05080000-4b92b4f0",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05080000-4b92b4f0-230b7dd3",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05080000-4b92b4f0",
                                "optional": false
                            },
                            "name": "configmap-renovate-05080000-4b92b4f0"
                        },
                        {
                            "name": "secret-renovate-05080000-4b92b4f0-230b7dd3",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05080000-4b92b4f0"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "kueue.konflux-ci.dev/requests-mintmaker": "1",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "mintmaker/results/742a0014-fc24-46d9-8ad4-131b85efc9cc/records/14479658-900c-4bec-a914-c168c53fcc0a",
                    "results.tekton.dev/result": "mintmaker/results/742a0014-fc24-46d9-8ad4-131b85efc9cc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-ba552d561e12c301a3815533520abe1f-00471bb35106c1d1-01\"}"
                },
                "creationTimestamp": "2026-05-08T00:00:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "kueue.x-k8s.io/priority-class": "konflux-dependency-update",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "mintmaker.appstudio.redhat.com/application": "integ-app-yrlw",
                    "mintmaker.appstudio.redhat.com/branch": "love-triangle-sockaf",
                    "mintmaker.appstudio.redhat.com/component": "konflux-test-integration-clone-huuzmj",
                    "mintmaker.appstudio.redhat.com/git-host": "github.com",
                    "mintmaker.appstudio.redhat.com/git-platform": "github",
                    "mintmaker.appstudio.redhat.com/namespace": "group-wvrx",
                    "mintmaker.appstudio.redhat.com/repo-branch-hash": "fd3a29f92f19",
                    "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_konflux-test-integration-clone",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-05080000-561bdcf9",
                    "tekton.dev/pipelineRun": "renovate-05080000-561bdcf9",
                    "tekton.dev/pipelineRunUID": "742a0014-fc24-46d9-8ad4-131b85efc9cc",
                    "tekton.dev/pipelineTask": "build"
                },
                "name": "renovate-05080000-561bdcf9-build",
                "namespace": "mintmaker",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-05080000-561bdcf9",
                        "uid": "742a0014-fc24-46d9-8ad4-131b85efc9cc"
                    }
                ],
                "resourceVersion": "134532",
                "uid": "14479658-900c-4bec-a914-c168c53fcc0a"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "mintmaker-controller-manager",
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05080000-561bdcf9",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05080000-561bdcf9-718f9880",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05080000-561bdcf9",
                                "optional": false
                            },
                            "name": "configmap-renovate-05080000-561bdcf9"
                        },
                        {
                            "name": "secret-renovate-05080000-561bdcf9-718f9880",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05080000-561bdcf9"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "emptyDir": {},
                        "name": "shared-data"
                    }
                ]
            },
            "status": {
                "completionTime": "2026-05-08T00:02:57Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:02:57Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-05080000-561bdcf9-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-05080000-561bdcf9-build-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-ba552d561e12c301a3815533520abe1f-00471bb35106c1d1-01"
                },
                "startTime": "2026-05-08T00:00:16Z",
                "steps": [
                    {
                        "container": "step-prepare-db",
                        "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:2fcc4c7dc48eb4196d2b7ca4296caf282b8fbfa9c11e5695699e050f15abd781",
                        "name": "prepare-db",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:57Z",
                            "message": "Step prepare-db terminated as pod renovate-05080000-561bdcf9-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:01:10Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-prepare-rpm-cert",
                        "imageID": "registry.access.redhat.com/ubi9@sha256:edabf9436bb372addcca3537aa76111c7a1aba970f5e3b02e2e03bc72943612d",
                        "name": "prepare-rpm-cert",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:57Z",
                            "message": "Step prepare-rpm-cert terminated as pod renovate-05080000-561bdcf9-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:01:14Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:57Z",
                            "message": "Step renovate terminated as pod renovate-05080000-561bdcf9-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:16Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05080000-561bdcf9",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05080000-561bdcf9-718f9880",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05080000-561bdcf9",
                                "optional": false
                            },
                            "name": "configmap-renovate-05080000-561bdcf9"
                        },
                        {
                            "name": "secret-renovate-05080000-561bdcf9-718f9880",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05080000-561bdcf9"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "kueue.konflux-ci.dev/requests-mintmaker": "1",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "mintmaker/results/bd7dd711-d336-40a6-b181-43829310adb3/records/36139ac0-e947-495d-9be8-79506aa4f587",
                    "results.tekton.dev/result": "mintmaker/results/bd7dd711-d336-40a6-b181-43829310adb3",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9a2986c649e2d330d85bd6fd6c96cbd0-429fd9257b24d997-01\"}"
                },
                "creationTimestamp": "2026-05-08T00:00:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "kueue.x-k8s.io/priority-class": "konflux-dependency-update",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "mintmaker.appstudio.redhat.com/application": "integ-app-yrlw",
                    "mintmaker.appstudio.redhat.com/branch": "love-triangle-sockaf",
                    "mintmaker.appstudio.redhat.com/component": "go-component-jzvddq",
                    "mintmaker.appstudio.redhat.com/git-host": "github.com",
                    "mintmaker.appstudio.redhat.com/git-platform": "github",
                    "mintmaker.appstudio.redhat.com/namespace": "group-wvrx",
                    "mintmaker.appstudio.redhat.com/repo-branch-hash": "2ba87e4a2868",
                    "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-05080000-9dca3642",
                    "tekton.dev/pipelineRun": "renovate-05080000-9dca3642",
                    "tekton.dev/pipelineRunUID": "bd7dd711-d336-40a6-b181-43829310adb3",
                    "tekton.dev/pipelineTask": "build"
                },
                "name": "renovate-05080000-9dca3642-build",
                "namespace": "mintmaker",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-05080000-9dca3642",
                        "uid": "bd7dd711-d336-40a6-b181-43829310adb3"
                    }
                ],
                "resourceVersion": "133620",
                "uid": "36139ac0-e947-495d-9be8-79506aa4f587"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "mintmaker-controller-manager",
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05080000-9dca3642",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05080000-9dca3642-0753b328",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05080000-9dca3642",
                                "optional": false
                            },
                            "name": "configmap-renovate-05080000-9dca3642"
                        },
                        {
                            "name": "secret-renovate-05080000-9dca3642-0753b328",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05080000-9dca3642"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "emptyDir": {},
                        "name": "shared-data"
                    }
                ]
            },
            "status": {
                "completionTime": "2026-05-08T00:02:20Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:02:20Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-05080000-9dca3642-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-05080000-9dca3642-build-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-9a2986c649e2d330d85bd6fd6c96cbd0-429fd9257b24d997-01"
                },
                "startTime": "2026-05-08T00:00:16Z",
                "steps": [
                    {
                        "container": "step-prepare-db",
                        "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:2fcc4c7dc48eb4196d2b7ca4296caf282b8fbfa9c11e5695699e050f15abd781",
                        "name": "prepare-db",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:20Z",
                            "message": "Step prepare-db terminated as pod renovate-05080000-9dca3642-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:20Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-prepare-rpm-cert",
                        "imageID": "registry.access.redhat.com/ubi9@sha256:edabf9436bb372addcca3537aa76111c7a1aba970f5e3b02e2e03bc72943612d",
                        "name": "prepare-rpm-cert",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:20Z",
                            "message": "Step prepare-rpm-cert terminated as pod renovate-05080000-9dca3642-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:24Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:20Z",
                            "message": "Step renovate terminated as pod renovate-05080000-9dca3642-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:16Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05080000-9dca3642",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05080000-9dca3642-0753b328",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05080000-9dca3642",
                                "optional": false
                            },
                            "name": "configmap-renovate-05080000-9dca3642"
                        },
                        {
                            "name": "secret-renovate-05080000-9dca3642-0753b328",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05080000-9dca3642"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "kueue.konflux-ci.dev/requests-mintmaker": "1",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "mintmaker/results/cc6edf9f-beee-469b-b39a-f0ec26a1cb31/records/de992e64-af46-4f0b-b2f2-4bc273f6de8d",
                    "results.tekton.dev/result": "mintmaker/results/cc6edf9f-beee-469b-b39a-f0ec26a1cb31",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7a99f723b1eac85a27649ec6e0677a84-82936320542660e4-01\"}"
                },
                "creationTimestamp": "2026-05-08T00:00:15Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "kueue.x-k8s.io/priority-class": "konflux-dependency-update",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "mintmaker.appstudio.redhat.com/application": "build-suite-component-update-gnbh",
                    "mintmaker.appstudio.redhat.com/branch": "multi-component-parent-base-vpgn",
                    "mintmaker.appstudio.redhat.com/component": "gh-multi-component-parent-vpgn",
                    "mintmaker.appstudio.redhat.com/git-host": "github.com",
                    "mintmaker.appstudio.redhat.com/git-platform": "github",
                    "mintmaker.appstudio.redhat.com/namespace": "build-e2e-uftk",
                    "mintmaker.appstudio.redhat.com/repo-branch-hash": "ad78f777ee32",
                    "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_build-nudge-parent-zuzpjt",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-05080000-c0d83b1e",
                    "tekton.dev/pipelineRun": "renovate-05080000-c0d83b1e",
                    "tekton.dev/pipelineRunUID": "cc6edf9f-beee-469b-b39a-f0ec26a1cb31",
                    "tekton.dev/pipelineTask": "build"
                },
                "name": "renovate-05080000-c0d83b1e-build",
                "namespace": "mintmaker",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-05080000-c0d83b1e",
                        "uid": "cc6edf9f-beee-469b-b39a-f0ec26a1cb31"
                    }
                ],
                "resourceVersion": "133566",
                "uid": "de992e64-af46-4f0b-b2f2-4bc273f6de8d"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "mintmaker-controller-manager",
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05080000-c0d83b1e",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05080000-c0d83b1e-7b680258",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05080000-c0d83b1e",
                                "optional": false
                            },
                            "name": "configmap-renovate-05080000-c0d83b1e"
                        },
                        {
                            "name": "secret-renovate-05080000-c0d83b1e-7b680258",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05080000-c0d83b1e"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "emptyDir": {},
                        "name": "shared-data"
                    }
                ]
            },
            "status": {
                "completionTime": "2026-05-08T00:02:17Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-08T00:02:17Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-05080000-c0d83b1e-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-05080000-c0d83b1e-build-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-7a99f723b1eac85a27649ec6e0677a84-82936320542660e4-01"
                },
                "startTime": "2026-05-08T00:00:15Z",
                "steps": [
                    {
                        "container": "step-prepare-db",
                        "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:2fcc4c7dc48eb4196d2b7ca4296caf282b8fbfa9c11e5695699e050f15abd781",
                        "name": "prepare-db",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:17Z",
                            "message": "Step prepare-db terminated as pod renovate-05080000-c0d83b1e-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:19Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-prepare-rpm-cert",
                        "imageID": "registry.access.redhat.com/ubi9@sha256:edabf9436bb372addcca3537aa76111c7a1aba970f5e3b02e2e03bc72943612d",
                        "name": "prepare-rpm-cert",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:17Z",
                            "message": "Step prepare-rpm-cert terminated as pod renovate-05080000-c0d83b1e-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:25Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-08T00:02:17Z",
                            "message": "Step renovate terminated as pod renovate-05080000-c0d83b1e-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-08T00:00:15Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05080000-c0d83b1e",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05080000-c0d83b1e-7b680258",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05080000-c0d83b1e",
                                "optional": false
                            },
                            "name": "configmap-renovate-05080000-c0d83b1e"
                        },
                        {
                            "name": "secret-renovate-05080000-c0d83b1e-7b680258",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05080000-c0d83b1e"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/02a75366-0767-4fd7-a7a4-2b885615b8f1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-c083e881d748bcc6-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:37:41Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "tes0f3eaa80491b7cb09faf4773fcafd987-deprecated-base-image-check",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "77294",
                "uid": "02a75366-0767-4fd7-a7a4-2b885615b8f1"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:40:22Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:40:22Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "tes0f3eaa80491b7cb09faf47738e466876c402fae84d79a2314451ceb3-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef\", \"digests\": [\"sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:39:18+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-c083e881d748bcc6-01"
                },
                "startTime": "2026-05-07T23:37:41Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c220318833fd10aab7e239c825b54d5cc2f85b590c164bccc887f9a2e7fb3e01",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:40:22Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef\\\", \\\"digests\\\": [\\\"sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:39:18+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:39:11Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-fc92519186",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/174d0a2c-3433-422c-9c81-a5bbb8959552",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-3d186e8bb811b14e-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:35:49Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-comp0f3eaa80491b7cb09faf4773fcafd987-prefetch-dependencies",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "67458",
                "uid": "174d0a2c-3433-422c-9c81-a5bbb8959552"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies:0.3@sha256:214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "source",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-771b0cba48"
                        }
                    },
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-dybrfd"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:35:58Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:35:58Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp0f3eaa80491b7cb09f7c3d147f12a4c1dea801d6a30eef608e-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f"
                        },
                        "entryPoint": "prefetch-dependencies",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies"
                    }
                },
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-3d186e8bb811b14e-01"
                },
                "startTime": "2026-05-07T23:35:49Z",
                "steps": [
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://05268045d0d85c174dfaca100e1ed8cb7c0dac1c81c4a8c5038c03ca8bb3cd5c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:58Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:54Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/workspace/source/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/workspace/source/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/workspace/source/cachi2/cachi2.env /workspace/source/cachi2/prefetch.env /workspace/source/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e /mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace with the source code, prefetch artifacts will be stored on the workspace as well",
                            "name": "source"
                        },
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/8c2854c1-fd68-4893-b8cd-6b0afcdd4fff",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-eafdd161c226767f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:37:41Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-compon0f3eaa80491b7cb09faf4773fcafd987-rpms-signature-scan",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "76537",
                "uid": "8c2854c1-fd68-4893-b8cd-6b0afcdd4fff"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "completionTime": "2026-05-07T23:39:39Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:39:39Z",
                        "message": "the step \"output-results\" in TaskRun \"test-compon0f3eaa80491b7cb09faf4773fcafd987-rpms-signature-scan\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-compon0f3eaa80491b7cb0555e24cc69c70e3a6a6bbbb619fe2fcc-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-eafdd161c226767f-01"
                },
                "startTime": "2026-05-07T23:37:42Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:39:39Z",
                            "message": "Step rpms-signature-scan terminated as pod test-compon0f3eaa80491b7cb0555e24cc69c70e3a6a6bbbb619fe2fcc-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:39:39Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-output-results",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:39:39Z",
                            "message": "Step output-results terminated as pod test-compon0f3eaa80491b7cb0555e24cc69c70e3a6a6bbbb619fe2fcc-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:37:41Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-fc92519186",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/1997d73a-e2dd-472c-af3a-57e50fc96ab9",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-bf4ed4a2bf3f6fa7-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:37:41Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-compone0f3eaa80491b7cb09faf4773fcafd987-sast-unicode-check",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "76747",
                "uid": "1997d73a-e2dd-472c-af3a-57e50fc96ab9"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check:0.4@sha256:c162d9d0cd1e4c64dfc340577ba8e6bf55ebd1bb859fe3157217de9b4473c640"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-771b0cba48"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:39:44Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:39:44Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-compone0f3eaa80491b7cb595977ec7a0f15f1291daa03a27d4c81-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c162d9d0cd1e4c64dfc340577ba8e6bf55ebd1bb859fe3157217de9b4473c640"
                        },
                        "entryPoint": "sast-unicode-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:39:42+00:00\",\"note\":\"Task sast-unicode-check success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-bf4ed4a2bf3f6fa7-01"
                },
                "startTime": "2026-05-07T23:37:41Z",
                "steps": [
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://911575447d788332d7bca9d308f69a6b7f66a1b3055ce2e54235a4a87dd8df21",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:39:42Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:39:42+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:39:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1ad5eba9ad5ec9c680e658987e8ba342246153c0bc5218b55a87e48bb1143f7c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:39:44Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:39:42+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:39:42Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/workspace/workspace"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n    PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n    \u003eraw_sast_unicode_check_out.txt \\\n    2\u003eraw_sast_unicode_check_out.log \\\n    || FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n    echo \"Failed to run find-unicode-control command\" \u003e\u00262\n    cat raw_sast_unicode_check_out.log\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n    echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n    --mode=json\n    --remove-duplicates\n    --embed-context=3\n    --set-scan-prop=\"${SCAN_PROP}\"\n    --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003e processed_sast_unicode_check_out.json 2\u003e processed_sast_unicode_check_out.err; then\n    echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n    cat processed_sast_unicode_check_out.err\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n        echo \"INFO: Trying to clone known-false-positives..\"\n        git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    # Build initial csfilter-kfp command\n    csfilter_kfp_cmd=(\n        csfilter-kfp\n        --verbose\n        --kfp-dir=\"${KFP_DIR}\"\n        --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    # Append --record-excluded option if RECORD_EXCLUDED is true\n    if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n        csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    # Execute the command and capture any errors\n    set +e\n    \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003e sast_unicode_check_out.json 2\u003e sast_unicode_check_out.error\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n        echo \"WARN: failed to filter known false positives\" \u003e\u00262\n        mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n    else\n        echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003e sast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n    note=\"Task sast-unicode-check success: No finding was detected\"\n    ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s  sast_unicode_check_out.sarif ]]; then\n    note=\"Task sast-unicode-check success: Some findings were detected, but filtered by known false positive\"\n    ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n    echo \"sast-unicode-check test failed because of the following issues:\"\n    cat sast_unicode_check_out.json\n    TEST_OUTPUT=\n    parse_test_output \"sast-unicode-check\" sarif sast_unicode_check_out.sarif  || true\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-unicode-check"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0;\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n    if [ ! -f \"${UPLOAD_FILE}\" ]; then\n      echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n      continue\n    fi\n\n    if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n        MEDIA_TYPE=application/json\n    else\n        MEDIA_TYPE=application/sarif+json\n    fi\n\n    echo \"Selecting auth\"\n    select-oci-auth \"${IMAGE_URL}\" \u003e \"${HOME}/auth.json\"\n    echo \"Attaching to ${IMAGE_URL}\"\n    retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-unicode-check"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/e17baa40-aef5-4819-ac5f-4c9775e3a565",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-a642a30eaa4485c4-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:37:13Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-componen0f3eaa80491b7cb09faf4773fcafd987-build-image-index",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "72789",
                "uid": "e17baa40-aef5-4819-ac5f-4c9775e3a565"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:37:40Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:37:40Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-componen0f3eaa80491b7c9e350ff96928ad201d6388c1113b1a91-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-a642a30eaa4485c4-01"
                },
                "startTime": "2026-05-07T23:37:13Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ec6ec5bd667d99cbe57ebf39d5a405918e9f24e8c3f07e636b7f341d7d464470",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:37:36Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:37:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://24409502cb518f260ae8725ca48402a66e664ed2fe0536c3ab83a4c89c11ca02",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:37:37Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:37:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://739e151c5d659f01af5c45552a7839a32b8abda0278ac5ec56710d8fa02e8d76",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:37:39Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:37:37Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"test-componen0f3eaa80491b7cb09faf4773fcafd987-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/3dfc1a1d-a126-4c4f-9430-e6ba9720cd56",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-a77bf898ac33c0ab-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:37:41Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-component-pac-eznbmv-on-pubdc39dcc21ed95dfaef2bef17ea2781b",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "80772",
                "uid": "3dfc1a1d-a126-4c4f-9430-e6ba9720cd56"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:42:12Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:42:12Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-eznbmv-o102fdff0fe8c5b8f66460972accbcf3c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef\", \"digests\": [\"sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1778197265\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-a77bf898ac33c0ab-01"
                },
                "startTime": "2026-05-07T23:37:41Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://93b7bfc36d3d17325a70343e1270734bf34eedfef9886c86e3883d1b33f77f41",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:40:46Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:40:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://1a10d5f47046b7dad205cc03e700bee7ab87a8cff681d52cb518d3b45fc3f893",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:40:46Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7a0b33d070fb03c6fa6cadf68ad25421879715ddb2352d96f94a95c316e510e2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:40:47Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b5a46fa5a0e7cd39d799a3f6e015ca0d7a85f8045d603610aee674d2ec8679dc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:40:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef\", \"digests\": [\"sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1778197265\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://2874604fd0b87bf3c480f6c9e48b8ba83e1853b218d94de737c9a60d805c244f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef\\\", \\\"digests\\\": [\\\"sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"1778197265\\\",\\\"note\\\":\\\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\\\",\\\"successes\\\":7,\\\"failures\\\":1,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:05Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1778197265\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://2d7805d2f1b447c913c90cb416aba015070a691726919fcbe94c7bad3e6dc23f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:42:11Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"1778197265\\\",\\\"note\\\":\\\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\\\",\\\"successes\\\":7,\\\"failures\\\":1,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:41:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/3db50a6b-979f-41e8-b968-da6a75c02855",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-baccc4b04f4451d6-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:37:41Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-component-pac-eznbmv-on-pull-request-9jchc-apply-tags",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "74955",
                "uid": "3db50a6b-979f-41e8-b968-da6a75c02855"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:38:57Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:38:57Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-eznbmv-on-pull-request-9jchc-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-baccc4b04f4451d6-01"
                },
                "startTime": "2026-05-07T23:37:42Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://154054a8391f8afd59a78c3c133c9227d4b7904210322c954e7d392798784f80",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:38:56Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:38:53Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                                "--digest",
                                "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-fc92519186",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/227b3d7c-e54c-47f3-9e6f-b182114afd87",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-126e037418184483-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:35:59Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-min",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-component-pac-eznbmv-on-pull-request-9jchc-build-container",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "71110",
                "uid": "227b3d7c-e54c-47f3-9e6f-b182114afd87"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-min:0.9"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "source",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-771b0cba48"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:37:13Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:37:13Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-eznbmv-oafaac20959f09bf6bab94d3dae7a687c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "83455b969b5b0f5e8cd96708b393343123754ec01d3d3cdaf531208693978a50"
                        },
                        "entryPoint": "buildah-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv@sha256:c5f4f30613a0cebbbf4f4855c40fd8e8dc3065f9f161a03e6d3ef8aa1dc94d38"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-126e037418184483-01"
                },
                "startTime": "2026-05-07T23:35:59Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://34f3609998cc0353b6dc23723c62b46b500e936360afeba9c5acc3fb40cd8776",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:37Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:36:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://95ed3a104e347102aae1a886ffa4600e209c59172db43c36a4c8edb78101d873",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:49Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:36:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://46eed9e64da41129e95668bc243b63b4731242ed103194dda9258fc29c039d89",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:36:59Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:36:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2cb7ae636d074b53c0b39627453fad67e41d0a08a815d1c192428aa08b9bf5ac",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:37:08Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:37:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://21708d63435dd1c5e39a0422cf5631ec0aab88a87cdffb106e9905f5b0999e0d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:37:13Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef@sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv@sha256:c5f4f30613a0cebbbf4f4855c40fd8e8dc3065f9f161a03e6d3ef8aa1dc94d38\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:37:09Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "2Gi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "512Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n  \"$source_dir_path\" | \"$source_dir_path/\"*)\n    # path is valid, do nothing\n    ;;\n  *)\n    echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n    echo \"Source path: $source_dir_path\" \u003e\u00262\n    echo \"Resolved path: $context_dir_path\" \u003e\u00262\n    exit 1\n    ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e /etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n    case $1 in\n        --build-args)\n            shift\n            # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n            # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n            # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do build_args+=(\"$1\"); shift; done\n            ;;\n        --env)\n            shift\n            # Collect env entries of the form KEY=value\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do env_vars+=(\"$1\"); shift; done\n            ;;\n        --labels)\n            shift\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do LABELS+=(\"--label\" \"$1\"); shift; done\n            ;;\n        --annotations)\n            shift\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ANNOTATIONS+=(\"--annotation\" \"$1\"); shift; done\n            ;;\n        *)\n            echo \"unexpected argument: $1\" \u003e\u00262\n            exit 2\n            ;;\n    esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e /shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n    jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"\n    then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ] ; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ] ; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/workspace/source/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e /shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/workspace/source/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n      -e 'H;1h;$!d;x' \\\n      -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n      \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null` `\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e \"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key \\\n                  -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z \\\n                  -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"\n    then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e /dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c \"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n    buildah build\n    \"${VOLUME_MOUNTS[@]}\"\n    \"${BUILDAH_ARGS[@]}\"\n    \"${LABELS[@]}\"\n    \"${ANNOTATIONS[@]}\"\n    --tls-verify=\"$TLSVERIFY\" --no-cache\n    --ulimit nofile=4096:4096\n    --http-proxy=false\n    -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e /shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "test-component-pac-eznbmv-on-pull-request-9jchc-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"\nthen\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/workspace/source/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"\nthen\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c \"/workspace/source\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/workspace/source/image-digest\"\n} \u003e \"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"\nthen\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n  [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n  [rekorInternalUrl]=REKOR_URL\n  [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n  [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n  [rekorInternalUrl]=rekorExternalUrl\n  [fulcioInternalUrl]=fulcioExternalUrl\n  [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e /shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n  then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e /tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"\n  then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\n  cyclonedx)\n    syft_sbom_type=cyclonedx-json@1.5 ;;\n  spdx)\n    syft_sbom_type=spdx-json@2.3 ;;\n  *)\n    echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n    exit 1\n    ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/workspace/source/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/workspace/source/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/workspace/source/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/source/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "10m",
                                    "memory": "128Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n    --additional-base-images)\n      shift\n      while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ADDITIONAL_BASE_IMAGES+=(\"$1\"); shift; done\n      ;;\n    *)\n      echo \"unexpected argument: $1\" \u003e\u00262\n      exit 2\n      ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/workspace/source/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/workspace/source/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/workspace/source/sbom-source.json\")\nfi\n\nif [ -f \"/workspace/source/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/workspace/source/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n  then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"\n  then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace containing the source code to build.",
                            "name": "source"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/52280672-b428-41ee-84d1-daaeadafc329",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-74c51866cdc69bf9-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:37:41Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-component-pac-eznbmv-on-pull-request-9jchc-clair-scan",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "78264",
                "uid": "52280672-b428-41ee-84d1-daaeadafc329"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "completionTime": "2026-05-07T23:40:45Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:40:45Z",
                        "message": "the step \"get-vulnerabilities\" in TaskRun \"test-component-pac-eznbmv-on-pull-request-9jchc-clair-scan\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/clair-in-ci:v1\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-eznbmv-on-pull-request-9jchc-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-74c51866cdc69bf9-01"
                },
                "startTime": "2026-05-07T23:37:41Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:40:45Z",
                            "message": "Step get-image-manifests terminated as pod test-component-pac-eznbmv-on-pull-request-9jchc-clair-scan-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:40:44Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:40:45Z",
                            "message": "Step get-vulnerabilities terminated as pod test-component-pac-eznbmv-on-pull-request-9jchc-clair-scan-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:37:41Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:40:45Z",
                            "message": "Step oci-attach-report terminated as pod test-component-pac-eznbmv-on-pull-request-9jchc-clair-scan-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:40:42Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:40:45Z",
                            "message": "Step conftest-vulnerabilities terminated as pod test-component-pac-eznbmv-on-pull-request-9jchc-clair-scan-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:40:43Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/6a3810f6-ae9b-4a58-8028-cb86e4d5e508",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-badd5e1ba287d16d-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:37:41Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-component-pac-eznbmv-on-pull-request-9jchc-clamav-scan",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "76823",
                "uid": "6a3810f6-ae9b-4a58-8028-cb86e4d5e508"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "completionTime": "2026-05-07T23:39:52Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:39:52Z",
                        "message": "the step \"upload\" in TaskRun \"test-component-pac-eznbmv-on-pull-request-9jchc-clamav-scan\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-eznbmv-on-pull-request-9jchc-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-badd5e1ba287d16d-01"
                },
                "startTime": "2026-05-07T23:37:41Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:1093f897c407e60cfcee4e4c0ae43189c30a8a2b6a03d940487de8e7e1f5fb9b",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:39:52Z",
                            "message": "Step extract-and-scan-image terminated as pod test-component-pac-eznbmv-on-pull-request-9jchc-clamav-scan-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:39:09Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-upload",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-07T23:39:52Z",
                            "message": "Step upload terminated as pod test-component-pac-eznbmv-on-pull-request-9jchc-clamav-scan-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-07T23:37:41Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/0c29a86c-d2d5-4388-bc7e-cbf175b44547",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-1d480369fe003983-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:35:07Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-component-pac-eznbmv-on-pull-request-9jchc-init",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "65616",
                "uid": "0c29a86c-d2d5-4388-bc7e-cbf175b44547"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:35:18Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:35:18Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-eznbmv-on-pull-request-9jchc-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-1d480369fe003983-01"
                },
                "startTime": "2026-05-07T23:35:07Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4159647647e9ce4524804489882fe393d2b2c3e47558cc32ccfcff65205baa1e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:18Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:17Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-fc92519186",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/2ccf8c40-99b1-447a-a736-c6e076b716a1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-542ddd18fd1b4dee-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:37:41Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-component-pac-eznbmv-on-pull-request-9jchc-push-dockerfile",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "74154",
                "uid": "2ccf8c40-99b1-447a-a736-c6e076b716a1"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile:0.3@sha256:359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-771b0cba48"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:38:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:38:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-eznbmv-od3b54cc04c41d00edcc6cdfdc3fb465b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7"
                        },
                        "entryPoint": "push-dockerfile",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv@sha256:09090d9cc34179cc11b6a74be329acac654510607504cb5a21b2b31c870ea572"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-542ddd18fd1b4dee-01"
                },
                "startTime": "2026-05-07T23:37:42Z",
                "steps": [
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b006eb088346859dd52b631dc7c74afa428494c75fdff66fc65637131120b188",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:38:30Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv@sha256:09090d9cc34179cc11b6a74be329acac654510607504cb5a21b2b31c870ea572\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:38:29Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        },
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                ".",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                                "--image-digest",
                                "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/workspace/workspace"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace containing the source code from where the Dockerfile is discovered.",
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-fc92519186",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/8331e600-9e73-4ba6-90e7-5c2ed2312244",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-6ab99de979d73f73-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:37:41Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-component-pac-eznbmv-on-pull-request-9jchc-sast-snyk-check",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "75909",
                "uid": "8331e600-9e73-4ba6-90e7-5c2ed2312244"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check:0.4@sha256:566753ca880764361b11f2c67d8e62dda94f829b11cb48e4716f27568216a481"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-771b0cba48"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:39:21Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:39:21Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-eznbmv-o9b25c16bbe5553458a8ba2994c848416-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "566753ca880764361b11f2c67d8e62dda94f829b11cb48e4716f27568216a481"
                        },
                        "entryPoint": "sast-snyk-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-07T23:39:20+00:00\",\"note\":\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-6ab99de979d73f73-01"
                },
                "startTime": "2026-05-07T23:37:41Z",
                "steps": [
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://aabc179af84141fb35e5da5a87df3aa4941e96534b965d89b1e1cef58f41770b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:39:20Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-07T23:39:20+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:39:19Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0315c83fa417657e4f8a1bcf9e506b387bbebc7d1747587decfc44939842d23e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:39:21Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-07T23:39:20+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:39:21Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n    PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262\u003e\u003e stdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/workspace/workspace\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c \"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd  \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) \\\n    | csgrep --mode=json --strip-path-prefix=\"source/\"  \\\n    \u003e sast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003e filtered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if (( total_files \u003e 0 )); then\n      coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n                      --set-scan-prop snyk-scanned-files-success:\"${supported_files}\"  \\\n                      --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n                      filtered_sast_snyk_check_out.json  \u003e sast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e \"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check\" sarif \"$RESULT_SARIF\"  || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-snyk-check"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n    if [ ! -f \"${UPLOAD_FILE}\" ]; then\n      echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n      continue\n    fi\n    if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n        MEDIA_TYPE=application/json\n    else\n        MEDIA_TYPE=application/sarif+json\n    fi\n    echo \"Selecting auth\"\n    select-oci-auth \"${IMAGE_URL}\" \u003e \"${HOME}/auth.json\"\n    echo \"Attaching to ${IMAGE_URL}\"\n    if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\n    then\n      echo \"Failed to attach to ${IMAGE_URL}\"\n    fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-snyk-check"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-fc92519186",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/ce7f8459-cfd8-4df7-8365-18ed9f9f9da7",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-7a73d51ced57a71f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:35:19Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-component0f3eaa80491b7cb09faf4773fcafd987-clone-repository",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "66877",
                "uid": "ce7f8459-cfd8-4df7-8365-18ed9f9f9da7"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report"
                    },
                    {
                        "name": "revision",
                        "value": "94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone:0.1@sha256:7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "output",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-771b0cba48"
                        }
                    },
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-dybrfd"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:35:48Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:35:48Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component0f3eaa80491b7447cd72f3b7102342187624e428b8a02-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21"
                        },
                        "entryPoint": "git-clone",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778196890"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "94d0283"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-7a73d51ced57a71f-01"
                },
                "startTime": "2026-05-07T23:35:19Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://977745e19f6d22e049ac58bacdb7de139ff7c47ab5b1ce2f3b6a0212905a890a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:46Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report\",\"type\":1},{\"key\":\"commit\",\"value\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778196890\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"94d0283\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:46Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://27317f3c2d4b5cd7d987c022a50edbf97a8f7f3801df1616a9294c0119a32aab",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:35:47Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report\",\"type\":1},{\"key\":\"commit\",\"value\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778196890\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"94d0283\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:35:47Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone Task will clone a repo from the provided url into the output Workspace. By default the repo will be cloned into the root of your Workspace.",
                    "params": [
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "source",
                            "description": "Subdirectory inside the `output` Workspace to clone the repo into.",
                            "name": "subdirectory",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Clean out the contents of the destination directory if it already exists before cloning.",
                            "name": "deleteExisting",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Deprecated. Has no effect. Will be removed in the future.",
                            "name": "gitInitImage",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBDIRECTORY",
                                    "value": "source"
                                },
                                {
                                    "name": "PARAM_DELETE_EXISTING",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_GIT_INIT_IMAGE"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_OUTPUT_PATH",
                                    "value": "/workspace/output"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ] ; then\n  set -x\nfi\n\nif [ -n \"${PARAM_GIT_INIT_IMAGE}\" ]; then\n  echo \"WARNING: provided deprecated gitInitImage parameter has no effect.\"\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e \"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e \"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\n\ncleandir() {\n  # Delete any existing contents of the repo directory if it exists.\n  #\n  # We don't just \"rm -rf ${CHECKOUT_DIR}\" because ${CHECKOUT_DIR} might be \"/\"\n  # or the root of a mounted volume.\n  if [ -d \"${CHECKOUT_DIR}\" ] ; then\n    # Delete non-hidden files and directories\n    rm -rf \"${CHECKOUT_DIR:?}\"/*\n    # Delete files and directories starting with . but excluding ..\n    rm -rf \"${CHECKOUT_DIR}\"/.[!.]*\n    # Delete files and directories starting with .. plus any other character\n    rm -rf \"${CHECKOUT_DIR}\"/..?*\n  fi\n}\n\nif [ \"${PARAM_DELETE_EXISTING}\" = \"true\" ] ; then\n  cleandir\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\nif ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n  echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n  echo \"--- Git Status ---\"\n  git status\n  echo \"------------------\"\n  exit 1\nfi\n\n# Check if there are changes staged for commit\nif git diff --staged --quiet; then\n  echo \"No diff was found, skipping merge...\" \u003e\u00262\nelse\n  echo \"Merge successful (no conflicts found), committing...\"\nif ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n  echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n  exit 1\nfi\n  MERGED_SHA=$(git rev-parse HEAD)\n  echo \"New HEAD after merge: ${MERGED_SHA}\"\n  echo \"${MERGED_SHA}\" \u003e \"/tekton/results/merged_sha\"\nfi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e \"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e \"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ] ; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBDIRECTORY",
                                    "value": "source"
                                },
                                {
                                    "name": "WORKSPACE_OUTPUT_PATH",
                                    "value": "/workspace/output"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink\n  do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ] ; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ] ; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The git repo will be cloned onto the volume backing this Workspace.",
                            "name": "output"
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        },
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/commit_sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "build.appstudio.redhat.com/pull_request_number": "9640",
                    "build.appstudio.redhat.com/target_branch": "base-gqejvm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-fc92519186",
                    "pipeline.tekton.dev/release": "8d33f2ae87e5a20bce798055da0f3bfb6a08a46d",
                    "pipelinesascode.tekton.dev/branch": "base-gqejvm",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dybrfd",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-5c73bd6c60.cpmk.p3.openshiftapps.com/k8s/ns/stat-rep-tomz/tekton.dev~v1~PipelineRun/test-component-pac-eznbmv-on-pull-request-9jchc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gqejvm\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5/records/e55fb0b0-b9c9-481e-8041-be7ea89a69ca",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"94d0283cd770f5258ae274e9cc5a352c13fac0ef\",\"eventType\":\"pull_request\",\"pull_request-id\":9640}",
                    "results.tekton.dev/result": "stat-rep-tomz/results/8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f2c51fc20a4b842058f7e8cc3b1e8e2-2f94c8d19a6a4f92-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-eznbmv",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-07T23:37:41Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.43.0",
                    "appstudio.openshift.io/application": "integ-app-cela",
                    "appstudio.openshift.io/component": "test-component-pac-eznbmv",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "74927636345",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-eznbmv-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9640",
                    "pipelinesascode.tekton.dev/repository": "test-component-pac-eznbmv",
                    "pipelinesascode.tekton.dev/sha": "94d0283cd770f5258ae274e9cc5a352c13fac0ef",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRun": "test-component-pac-eznbmv-on-pull-request-9jchc",
                    "tekton.dev/pipelineRunUID": "8357a362-f5a1-480d-b88d-d80e2aa31da5",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check",
                    "test.appstudio.openshift.io/pr-group-sha": "b57a2633673ae1acb5500f1e91480e6a8f6ff2e41d6ef7baa605a513d6828d"
                },
                "name": "test-component0f3eaa80491b7cb09faf4773fcafd987-sast-shell-check",
                "namespace": "stat-rep-tomz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-eznbmv-on-pull-request-9jchc",
                        "uid": "8357a362-f5a1-480d-b88d-d80e2aa31da5"
                    }
                ],
                "resourceVersion": "76749",
                "uid": "e55fb0b0-b9c9-481e-8041-be7ea89a69ca"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-eznbmv",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check:0.1@sha256:2cd09c97b9f0fae9c7bcd26d956f77221fb7137ee8b2ef17e7351b5e6f1eb89e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-771b0cba48"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-07T23:39:45Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-07T23:39:45Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component0f3eaa80491b7a63f9b80e0cae13ac313a5186c221bea-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "2cd09c97b9f0fae9c7bcd26d956f77221fb7137ee8b2ef17e7351b5e6f1eb89e"
                        },
                        "entryPoint": "sast-shell-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-07T23:39:42+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4f2c51fc20a4b842058f7e8cc3b1e8e2-2f94c8d19a6a4f92-01"
                },
                "startTime": "2026-05-07T23:37:41Z",
                "steps": [
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:169f73f80fbde8d54f42416c5de8cc9214ecc7e8c89c70a3385285bbac32ad0a",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e4896ad15d3c3b4483a63296d5e2059111f4d1100d5357325f4ba7f1107528c2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:39:42Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:39:42+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:39:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:5da32f9d64fdb2a960792e282f739e9d398a69e4c43d7183323ea8a13b845c73",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://da27fb598dce35c89b0d8f00a344015e08098f341887975379ced43659a3e536",
                            "exitCode": 0,
                            "finishedAt": "2026-05-07T23:39:44Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-07T23:39:42+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-07T23:39:43Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.51@sha256:169f73f80fbde8d54f42416c5de8cc9214ecc7e8c89c70a3385285bbac32ad0a",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n    PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/workspace/workspace/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c \"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n    read -r quota period \u003c /sys/fs/cgroup/cpu.max\n    if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n        export SC_JOBS=$(((quota + period - 1) / period))\n        echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n    fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n    --mode=json\n    --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n    --remove-duplicates\n    --embed-context=3\n    --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n    # predefined list of shellcheck important findings\n    CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n    CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n    CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n    CSGREP_OPTS+=(\n        --event=\"$CSGREP_EVENT_FILTER\"\n    )\nelse\n    CSGREP_OPTS+=(\n        --event=\"error|warning\"\n    )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e \"$OUTPUT_FILE\"; then\n    echo \"Error occurred while running 'run-shellcheck.sh'\"\n    note=\"Task sast-shell-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n        echo \"INFO: Trying to clone known-false-positives..\"\n        git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    # build initial csfilter-kfp command\n    csfilter_kfp_cmd=(\n        csfilter-kfp\n        --verbose\n        --kfp-dir=\"${KFP_DIR}\"\n        --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n        csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    # Execute the command and capture any errors\n    set +e\n    \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e \"${OUTPUT_FILE}.filtered\" 2\u003e \"${OUTPUT_FILE}.error\"\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n        echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n        mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n        echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003e shellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-shell-check"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-tomz/test-component-pac-eznbmv:on-pr-94d0283cd770f5258ae274e9cc5a352c13fac0ef"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:641a19d87816ab84104fbaeb19be71a7e27ac1bf1877604f6ca5fe6bef0c8152"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:6a46c5960cbcb81d9f6b0206163102d6f2e9e649ec231136f9ee33c02d3c1ad0",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n    echo 'No image-url or image-digest param provided. Skipping upload.'\n    exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n    if [ ! -f \"${UPLOAD_FILE}\" ]; then\n        echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n        continue\n    fi\n\n    # Determine the media type based on the file extension\n    if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n        MEDIA_TYPE=\"application/json\"\n    else\n        MEDIA_TYPE=\"application/sarif+json\"\n    fi\n\n    echo \"Selecting auth\"\n    select-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n    echo \"Attaching to ${IMAGE_URL}\"\n    if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\n    then\n      echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n      exit 1\n    fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-shell-check"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "workspace"
                        }
                    ]
                }
            }
        }
    ],
    "kind": "List",
    "metadata": {
        "resourceVersion": ""
    }
}